walletweb3[.]limited
“Welcome | MySite”
Résumé des preuves
On July 25, 2026 the domain walletweb3.limited was observed as a crypto‑drainer infrastructure that has been taken offline. The site was hosted on Cloudflare’s network (ASN 13335) and resolved to the IP address 172.67.169.219, which is geolocated to the United States. DNS resolution used the Cloudflare‑provided nameservers etienne.ns.cloudflare.com and lady.ns.cloudflare.com, confirming that the registrar was Cloudflare, Inc. No TLS certificate was presented, indicating that the service was delivered over plain HTTP. The only visible page element retrieved during the scan was the HTML title “Welcome | MySite”, which does not reveal the intended victim brand or a specific login flow.
VirusTotal recorded seven detections out of ninety‑five scanned engines, and the domain appears on a single external blocklist. Independent security services have assigned a Gridinsoft trust score of 0 / 100 and PhishDestroy has listed the domain as blocked. The lack of a valid certificate, combined with the low trust score and multiple vendor detections, suggests that the site was likely used to solicit cryptocurrency transfers, fitting the “Crypto Scam” classification supplied in the intelligence.
Because the infrastructure is currently offline, live forensic collection is not possible; however, the recorded IP, nameserver configuration, and detection history provide a reliable fingerprint for future attribution. Defenders should continue to monitor the IP address and associated Cloudflare nameservers for re‑use, add the domain and its IP to internal blocklists, and ensure that any user‑facing applications enforce TLS‑only connections to prevent accidental redirection to similar unencrypted sites. Ongoing watch‑list updates from VirusTotal, PhishDestroy, and other threat‑intel feeds are recommended to capture any resurrection attempts.
Data Coverage
Processus de réponse aux menaces Pipeline
Couverture des listes de blocage
10 sources externes surveillées · instantané du 11/08/2026
10 sources externes surveillées Aucune correspondance
Chronologie de détection
-
Cloudflare Radar
Analyse Cloudflare Radar enregistrée · Ouvrir l’analyse
Capture enregistrée
Informations sur les domaines
Détails techniquesDNS, noms TLS et horodatages
ICANN OVERSIGHT
Contexte de l’accréditation et du RAA
Contexte de l’accréditation et du RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Analyse VirusTotal
Ce site vous a-t-il affecté ?
Si vous avez saisi des informations d'identification de compte, des informations personnelles ou de paiement, ou téléchargé un fichier à partir de ce domaine, agissez immédiatement. Vous trouverez ci-dessous des ressources pour vous aider à signaler l'incident et à vous protéger.
Signalez-le à vos autorités locales
Sélectionnez votre pays pour obtenir contacts officiels en matière de cybercriminalité ou créer un projet de plainte →.
Vérifier n'importe quel domaine
Analyse des menaces à l'aide de listes de blocage stockées, de WHOIS, de DNS et de preuves d'analyse publique
Scanner maintenantSignaler une tentative d'hameçonnage
Signalez les domaines suspects à notre base de données des menaces — protégez la communauté
SignalerFlux d'alertes en temps réel
Rapports de phishing récents et changements de disponibilité observés
SurveillerRestez informés, restez en sécurité
Surveillez les menaces en temps réel ou signalez cette alerte si vous pensez qu'il s'agit d'un faux positif