smartwallet-chain[.]web[.]app

Analysis of smartwallet-chain.web.app indicates active crypto drainer phishing infrastructure as of July 26, 2026. The domain is registered through Google LLC and resolves to IP address 199.36.158.100, though nameserver records return NS_NOT_FOUND, suggesting potential misconfiguration or deliberate evasion. While VirusTotal scans by 91 vendors currently show no detections, this absence does not confirm safety, particularly given the domain's presence on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The risk level is classified as high due to confirmed malicious activity targeting cryptocurrency wallets, with no indication of remediation or takedown.

Defenders should note that the domain remains operational despite blocklist entries, and the hosting provider (Google) has not intervened to suspend the resource. The lack of nameserver resolution may complicate passive DNS analysis but does not impede active connections to the site. No SSL certificate anomalies or HTTP status errors are reported, allowing the phishing page to load without immediate technical barriers. The exact content of the page has not been analyzed, but the classification as a crypto drainer suggests it is designed to execute unauthorized transactions from connected wallets.

Organizations should prioritize blocking this domain at the network and endpoint levels, particularly in environments handling cryptocurrency transactions. Given the domain's persistence and absence of vendor detections on VirusTotal, reliance on traditional antivirus or URL filtering alone may be insufficient. Security teams are advised to monitor for related infrastructure, such as additional subdomains or IP associations, and correlate with wallet drainer indicators reported by MetaMask and SEAL.