crustwallet[.]store

Analysis of crustwallet.store shows a newly registered domain (creation date 2025-10-29) that was used in a crypto‑drainer campaign. The domain resolves to the IPv6 address 2607:f1c0:100f:f000::200, which is assigned to AS8560 operated by IONOS SE in the United States. Registration was performed through IONOS SE and the authoritative name servers are ns1038.ui-dns.de, ns1053.ui-dns.org, ns1071.ui-dns.biz and ns1081.ui-dns.com. No TLS certificate was observed, indicating the site was only reachable over plain HTTP.

The infrastructure has been listed on a single security blocklist and is actively blocked by PhishDestroy. AlienVault OTX includes the domain in one pulse, and five of ninety‑five VirusTotal scanners flagged it as malicious. Independent trust‑rating services assign extremely low scores (Gridinsoft 0/100, Scamadviser 1/100). The site is currently taken offline, so live content cannot be inspected, and no page title or additional metadata have been captured.

Because the domain’s observable characteristics align with known crypto‑drainer patterns—recent registration, low‑reputation hosting, absence of SSL, and multiple vendor detections—defenders should treat the domain as hostile. Recommended actions include adding the domain and its IPv6 address to network deny lists, monitoring for any re‑registration or resurrection of the infrastructure, and enforcing outbound traffic controls that prevent connections to untrusted HTTP endpoints. Continuous threat‑intel feeds should be consulted for any new indicators tied to the AS8560 block or the listed nameservers.