pyntam-wallet[.]webflow[.]io

The domain pyntam-wallet.webflow.io is registered through MarkMonitor, Inc. and was created on May 08 2013. It resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site is protected by Cloudflare’s edge services and serves content over HTTP/3, while the TLS certificate is issued by Google Trust Services under the WE1 designation. Current DNS records list journey.ns.cloudflare.com and lamar.ns.cloudflare.com as authoritative name servers.

When accessed, the site returns an HTTP 404 status code and the page title “404 – Page not found”, indicating that the original payload is no longer publicly reachable. The domain has been classified as a crypto‑drainer scam and was previously flagged by PhishDestroy. VirusTotal analysis shows 11 of 95 security vendors mark the domain as malicious, and it appears on one external blocklist. No additional content, wallet addresses, or malicious payloads have been captured, and the site’s offline state limits further forensic observation.

Because the infrastructure—namely the Cloudflare front‑end, Google‑issued certificate, and the MarkMonitor registration—matches patterns used by known cryptocurrency theft campaigns, defenders should assume the domain was actively used to lure victims into transferring crypto assets. Recommended mitigation steps include adding the domain to network and email deny lists, monitoring DNS queries for the associated IP and name servers, and maintaining vigilance for any future re‑registration or resurrection of the subdomain. Continuous threat‑intel feeds should be consulted for updates, and any incidents involving similar crypto‑drainer activity should be correlated with the observed indicators.