walletverify[.]live

The domain walletverify.live has been identified as a brand impersonation threat targeting Google. Analysis confirms this domain was designed to deceive users into believing they are interacting with legitimate Google services, likely for credential theft or account compromise. Current status indicates the domain is offline, though prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 15, 2026, an unusually forward-dated registration that may indicate evasion tactics. It resolves to IP address 104.21.88.72, hosted via a content delivery network in Canada. Security vendors flagged this domain in 8 of 95 VirusTotal scans, and it appears on three distinct security blocklists. The SSL certificate was issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious domains due to its accessibility. The page title 'Just a moment...' suggests the use of anti-bot or cloaking mechanisms to obstruct automated analysis. While walletverify.live is currently offline, the domain remains a potential threat vector. Organizations should proactively block the domain and its resolving IP at the network perimeter. Users who may have interacted with this domain should immediately rotate credentials, enable multi-factor authentication, and review account activity for unauthorized access. Security teams are advised to monitor for re-emergence of this domain or similar infrastructure under new registrations, particularly those impersonating Google or other high-value brands.