walletcheck[.]online

The domain walletcheck.online was registered on November 08, 2025 through Hostinger operations, UAB and is currently taken offline. DNS resolution points to IP address 147.93.73.41, which belongs to AS47583 Hostinger International Limited located in Lithuania. No TLS certificate is presented for the host, and the authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, indicating a typical parking configuration. The site’s page title, as captured in intelligence feeds, is "zx | Test," providing no direct indication of the malicious payload but confirming the presence of a reachable HTTP endpoint at the time of observation.

The campaign is classified as Wallet/Seed Phishing and explicitly impersonates the Binance brand, targeting users who may be prompted to disclose cryptocurrency wallet credentials. Detection signals include a Gridinsoft trust score of 0 out of 100, placement on a single security blocklist, and a block by the PhishDestroy service. VirusTotal analysis shows that two of ninety‑five security vendors flagged the domain, and AlienVault OTX lists the indicator in one threat‑intel pulse.

While the low vendor count suggests limited exposure, the combination of a brand‑specific impersonation, a dedicated IP host, and a zero‑trust score warrants immediate defensive action. Network defenders should add walletcheck.online and its resolving IP 147.93.73.41 to deny lists, enforce strict outbound filtering for any Binance‑related traffic to unknown hosts, and monitor for any resurgence of the domain or similar patterns. Given the absence of SSL and the offline status, future activity may involve rapid redeployment on new infrastructure; therefore, continuous threat‑intel feeds should be consulted for re‑registration events or related indicators of compromise.