caulwallet[.]co[.]com

Analysis of caulwallet.co.com indicates a malicious infrastructure designed to harvest cryptocurrency wallet seeds by masquerading as a Discord‑related service. The domain resolves to IP address 45.82.82.240, which is attributed to Autonomous System AS9123 operated by JSC TIMEWEB in Russia. Hosting under this ASN suggests a low‑cost hosting environment often leveraged by threat actors. The domain is registered through Moniker Online Services LLC and is served by four nameservers (ns1.nic.co.com through ns4.nic.co.com), a configuration commonly observed in fast‑flux or disposable domains.

No SSL certificate was presented, meaning the site was only reachable via HTTP, a characteristic that reduces transport‑layer security and is typical of many phishing kits. The page title returned by the HTTP response is "Referral Program | Cault Wallet," confirming the presence of a wallet‑oriented landing page, while the listed brand target is Discord, indicating an attempt to lure Discord users into providing seed phrases. The site’s Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. It has been listed on five security blocklists and is actively blocked by multiple anti‑phishing services, including PhishDestroy, Polkadot, CryptoFirewall, Enkrypt, and Codeesura.

VirusTotal records show that 95 scanning engines have examined the domain without flagging any detections; however, the absence of detections does not constitute validation of safety. The domain was created on August 16, 1997, a date that predates the current threat landscape but may reflect a re‑use of an old registration. As of the report date, July 22, 2026, the site is offline, limiting immediate observation, but the documented infrastructure components remain relevant for threat‑intel correlation.