freewallet[.]org

This domain, freewallet.org, is currently flagged as a high‑risk crypto drainer. Automated analysis on July 12 2026 identified the site as actively serving fraudulent cryptocurrency‑related content, consistent with the observed page title “Freewallet | Multi‑currency Online Crypto Wallet for BTC, ETH, XMR and more”. The classification aligns with the single vendor detection on VirusTotal (1 of 95 security engines) and the presence on the PhishDestroy blocklist. Infrastructure analysis shows the domain resolves to the IP address 172.67.212.249, which belongs to AS13335 Cloudflare, Inc., located in the United States. The domain was registered on March 06 2026 through NameCheap, Inc., and uses the Cloudflare authoritative nameservers damon.ns.cloudflare.com and marjory.ns.cloudflare.com. TLS is provided by Google Trust Services under the WE1 certificate, indicating a valid HTTPS endpoint despite the malicious intent. The site returns an HTTP 403 status code, suggesting that the malicious payload may be served conditionally or is hidden behind access controls. Gridinsoft’s trust scoring engine assigned a low confidence value of 39 out of 100, reinforcing the suspicion of abusive activity. Only one security blocklist currently lists the domain, but the active detection by PhishDestroy and the single positive VirusTotal result demonstrate that the infrastructure is already being monitored by threat‑intel feeds. Defenders should immediately block DNS resolution for freewallet.org and the associated IP 172.67.212.249 at network perimeters. Monitoring of outbound connections to the Cloudflare edge is advised, as the underlying malicious server could shift behind the same CDN. Adding the domain to internal threat‑intel feeds, sinkholing traffic, and alerting users about unsolicited crypto‑wallet invitations will reduce exposure. Continuous re‑evaluation is recommended, given the recent registration date and the potential for rapid evolution of the campaign.