chekingwallet[.]bet

The domain chekingwallet.bet was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the IP address 104.21.1.57, which belongs to the AS13335 Cloudflare network located in the United States. The SSL certificate presented by the site is identified as WE1, indicating that TLS was in place when the domain was active. Threat intelligence sources classify the activity as a wallet/seed phishing campaign targeting the brand across, as reflected in the page title "AMLBot - Advanced Wallet Analysis".

VirusTotal records show that one out of ninety-three security vendors flagged the domain, providing a minimal but notable detection signal. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain appears on four public blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple mitigation services have already taken protective action. No additional public analysis of the site content is available beyond the page title, leaving the exact phishing workflow and payload delivery mechanisms uncertain.

Defenders should proactively block chekingwallet.bet at network perimeter and DNS layers, add the associated IP 104.21.1.57 to threat intelligence feeds, and monitor for any future re‑registration or similar naming patterns. Continuous observation of Cloudflare‑hosted infrastructure linked to this ASN is advised, as threat actors may reuse the same hosting environment for new campaigns. The combination of low trust score, blocklist presence, and the specific wallet‑related impersonation indicates a credible risk that warrants immediate inclusion in security controls.