testwallet[.]live

Analysis of testwallet.live indicates a high-risk crypto drainer domain active as of July 28, 2026. The domain is flagged by 15 of 91 security vendors on VirusTotal, confirming malicious classification by multiple detection engines. It appears on one security blocklist and is blocked by PhishDestroy, further validating its threat status.

The domain returns an HTTP 200 status, suggesting it is operational and serving content. Infrastructure analysis reveals registration through GoDaddy.com, LLC, with nameservers ns11.domaincontrol.com and ns12.domaincontrol.com, a common hosting pattern for malicious domains leveraging GoDaddy’s infrastructure. No additional details regarding the specific crypto drainer kit, targeted wallets, or associated campaigns are available in the current intelligence.

Defenders should treat this domain as active and malicious, prioritizing blocking at the DNS or proxy level to prevent user interaction. Given the domain’s registration and hosting provider, monitoring for newly registered domains under the same nameservers or registrar may help identify related threats. The exact content of the site remains unanalyzed, but the combination of detection vendor alerts and blocklist presence confirms its role in crypto theft operations.