wallet-assist-desk[.]app

Analysis indicates that the domain wallet-assist-desk.app resolves to the Amazon‑owned address 18.208.88.157 (AS14618, United States). The site returned an HTTP 404 response and is currently taken offline, which aligns with the reported status. VirusTotal records show that 15 of 95 scanned security vendors flagged the domain, reflecting a moderate detection rate consistent with known crypto‑drainer activity. Registration data reveals the domain was provisioned through Dynadot LLC, and the TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 chain, issued by DigiCert Inc. The certificate alone does not imply legitimacy, as it is a publicly trusted root commonly used by both legitimate and malicious operators.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, further corroborating its malicious reputation. The page title returned by the server is “Base Wallet Official Help Center,” matching the declared scam type of a crypto scam. Nameserver configuration points to nsone.net infrastructure (dns1.p02.nsone.net, dns2.p02.nsone.net). While the offline status limits immediate observation of payload delivery, the combination of flagged detections, blocklist inclusion, and deceptive page title suggests the domain was used to lure cryptocurrency users into disclosing private keys or authorizing transfers.

Defenders should continue to block the domain at network perimeter, update DNS filtering policies, and monitor for any resurgence of the domain or related sub‑domains. Additional investigation of traffic to the associated IP address may reveal other malicious assets hosted on the same Amazon infrastructure. Until the domain is definitively taken down, organizations handling crypto assets should treat any communications referencing “Base Wallet” or similar assistance services as suspicious.