cowalet[.]com

This domain, cowalet.com, is currently flagged as a high-risk brand impersonation threat, specifically targeting the cryptocurrency platform 'across'. The domain was registered through Tucows Domains Inc. on January 22, 2026, and is still active as of July 12, 2026. The page title 'Coin Market Wallet' suggests an attempt to deceive users into believing they are interacting with a legitimate cryptocurrency wallet service. Analysis indicates that the domain resolves to the IP address 64.20.38.219, which is located in the United States and is part of the AS19318 Interserver, Inc. network. The domain is detected to use technologies such as Tailwind CSS, LiteSpeed, and HTTP/3, which are commonly employed to create visually convincing and efficient phishing sites. The SSL certificate is issued by Let's Encrypt, providing an additional layer of trust that attackers often leverage to increase the credibility of their fraudulent operations. The domain has been flagged by 4 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. It is also blocked by PhishDestroy, further corroborating its malicious nature. Given the high risk level and the active status of the domain, defenders are advised to implement DNS-based blocking, monitor for any related phishing emails, and educate users on the signs of seed phishing attacks. Infrastructure analysis reveals that the domain is hosted on nameservers dns2028a.trouble-free.net and dns2028b.trouble-free.net, indicating a potential overlap with other malicious activities. The HTTP status code 200 confirms that the site is accessible and operational, posing an immediate threat to users who may visit it. Defenders should also consider enhancing their detection and response capabilities to identify and mitigate similar threats in their network.