hub-bestwallettoken[.]cfd

Analysis of hub-bestwallettoken.cfd shows a high‑risk crypto drainer that remains active as of July 24, 2026. The domain was registered on November 08, 2025 through Dynadot LLC and is hosted under the IP address 142.250.181.228, which belongs to AS15169 Google LLC and resolves to a United States location. DNS resolution uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s edge network for anonymity and performance. The site presents a HTTP 502 response, suggesting that the backend service is either intentionally misconfigured or temporarily unavailable, a common tactic to avoid content inspection while still serving malicious payloads when accessed. The SSL certificate is issued by Google Trust Services under the WE1 profile, providing a valid TLS chain that can lend false legitimacy to the site.

The page title returned by the server is "Google," a generic label that may be used to deceive users or automated scanners. Technology fingerprints include Bootstrap, jQuery, Cloudflare Browser Insights, and HTTP/3, all of which are typical of legitimate web applications but do not mitigate the malicious intent. VirusTotal scans have flagged the domain in four out of ninety‑five security vendors, reinforcing the suspicion raised by its inclusion on a known security blocklist. The domain is also listed as blocked by PhishDestroy, confirming that threat‑intel feeds have identified it as a crypto‑draining operation.

Defenders should immediately block hub-bestwallettoken.cfd at perimeter firewalls and DNS resolvers, add the associated IP address 142.250.181.228 to deny‑list rules, and monitor for any outbound connections to this host. Continuous scanning of the domain with sandbox and URL‑reputation services is advised, as the 502 status may mask intermittent malicious content delivery.