thirdfy-wallet[.]xyz

This domain, thirdfy-wallet.xyz, is currently flagged as a crypto drainer and remains active as of the report date of August 01, 2026. The domain was created on July 29, 2026, making it only three days old at the time of this assessment, which is a common characteristic of rapidly deployed malicious infrastructure. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and its nameservers are keanu.ns.cloudflare.com and vivienne.ns.cloudflare.com, indicating the use of Cloudflare's DNS services. The domain resolves to IP address 104.21.62.172, which is within Cloudflare's hosting range, and its SSL certificate is issued by Google Trust Services (WE1).

Infrastructure analysis indicates that the domain is listed on one security blocklist, PhishDestroy, which has flagged it for malicious activity. VirusTotal has scanned this domain with 91 vendors, and currently zero vendors flag it as malicious. This absence of detections is not proof that the domain is safe, as new or rapidly changing domains often evade initial detection. The domain's categorization as a crypto drainer is based on the threat type associated with it, though the exact content of the website has not yet been analysed in this report. It is unclear whether the site presents a specific brand or interface, as no page title or brand target information is available in the current data.

Defenders should treat this domain with caution due to its recent creation, its presence on a security blocklist, and its classification as a crypto drainer. The lack of current vendor detections may change quickly, and organizations should monitor for updates. It is advisable to block access to this domain at the network level and to educate users about the risks of interacting with newly registered domains that claim to offer wallet-related services. Further analysis of the domain's content, including any JavaScript or wallet connection functions, is recommended to confirm the threat.