mathwallet[.]top

The domain mathwallet.top is currently active and classified as a high‑risk crypto drainer. Analysis indicates that the site returns HTTP status 200 while its page title reports “404 Not Found”, a pattern often used to obscure malicious intent. The domain was created on April 10, 2024 and is hosted on a single IP address 154.23.179.54. Infrastructure analysis shows the domain is registered through Gname.com Pte. Ltd. and uses the authoritative name servers a.share-dns.com and b.share-dns.net. The resolved IP belongs to AS140227 Hong Kong Communications International Co., Limited, located in Hong Kong. The web server runs Nginx, enforces HTTP Strict Transport Security, and presents a Let’s Encrypt TLS certificate (R13), indicating a recent and freely issued certificate. Threat intelligence sources list the domain on one public blocklist, specifically PhishDestroy, and 10 out of 95 security vendors on VirusTotal have flagged it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of a dangerous infrastructure. The combination of a newly created domain, low trust score, presence on a blocklist, and the contradictory HTTP response aligns with the high‑risk rating and the active status reported. Defenders should block DNS resolution for mathwallet.top and the associated IP 154.23.179.54 at perimeter firewalls and endpoint protection solutions. Continuous monitoring of traffic to the identified nameservers and the AS140227 network is advised, as well as updating intrusion‑detection signatures to capture the Nginx/HSTS fingerprint. Organizations that handle cryptocurrency assets should treat any communications referencing mathwallet.top as malicious, employ sinkholing for the IP address, and educate users to avoid interacting with the domain.