The domain walletmagic.link was registered on July 21, 2026 and remains active as of the report date, July 29, 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 35.157.26.135. The registrar listed is Hosting Concepts B.V. d/b/a Registrar.eu, and the authoritative name servers are dns1.p02.nsone.net, dns2.p02.nsone.net, dns3.p02.nsone.net, and dns4.p02.nsone.net.
VirusTotal scans have flagged the domain in 13 of 91 security vendor engines, indicating a notable detection rate among static and dynamic analyses. The domain appears on a single public blocklist and is currently blocked by the PhishDestroy filtering service. The threat classification supplied is a crypto drainer, which suggests the site is designed to illicitly capture cryptocurrency credentials or redirect transaction flows.
No additional data on SSL/TLS certificates, HTTP status codes, page title, or other reputation services such as Google Safe Browsing or OTX have been reported, leaving those vectors unverified at this time. Defenders are advised to add walletmagic.link to network‑level deny lists, monitor DNS queries for the associated IP address, and consider sinkholing the domain to disrupt the campaign. Continuous re‑evaluation is recommended as further intelligence, such as content analysis or additional vendor detections, may emerge.