dcentwallet-guide[.]help

This domain, dcentwallet-guide.help, is flagged as an active crypto drainer phishing site targeting users of hardware wallet solutions. Analysis indicates the domain was registered on May 20, 2026, through NameSilo, LLC, and currently resolves to IP address 172.67.169.156, hosted on Cloudflare's infrastructure (AS13335). The page title, 'D'CENT | Secure Crypto Wallet - Top Hardware Wallet Solution,' suggests an attempt to impersonate the legitimate D'CENT wallet brand, a tactic commonly used to deceive users into interacting with malicious smart contracts or wallet-draining scripts. Infrastructure analysis reveals the domain is protected by Cloudflare nameservers (cartman.ns.cloudflare.com and meiling.ns.cloudflare.com) and presents a valid SSL certificate issued by Let's Encrypt, which may complicate detection efforts. The site remains operational with an HTTP 200 status, indicating no server-side blocking or takedown at this time. Security vendors have flagged the domain, with 2 of 91 engines on VirusTotal identifying it as malicious, and it appears on at least one security blocklist. While the exact content of the site has not been analyzed, the combination of a recent registration, Cloudflare hosting, and a page title mimicking a trusted hardware wallet brand aligns with known crypto drainer campaigns. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency transactions occur. Users should be alerted to avoid interacting with the site, as any wallet connections may result in unauthorized fund transfers. Further investigation into associated wallet addresses or smart contracts is recommended to trace stolen assets.