wallet[.]canton[.]mainnet[.]nodefortress[.]io

This domain, wallet.canton.mainnet.nodefortress.io, is flagged as a high-risk crypto drainer threat. Registered on May 14, 2026, through Amazon Registrar, Inc., its infrastructure is hosted behind Cloudflare, resolving to IP 104.20.36.172 located in Canada. The domain's page title claims to be a 'Canton Network Wallet Application,' which aligns with the crypto drainer classification. Security analysis shows a Gridinsoft trust score of 0 out of 100, indicating strong distrust. VirusTotal detection reports 1 out of 92 security vendors flagging this domain as malicious. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), and nameservers are edward.ns.cloudflare.com and melany.ns.cloudflare.com. The HTTP status returned is 530, suggesting a Cloudflare-origin issue. The domain remains active as of the report date. Defenders should treat this domain as an active threat, block all traffic to it, and monitor for related subdomains or variations. The exact nature of the scam—whether it involves credential harvesting, wallet connection prompts, or direct fund theft—is not specified beyond the crypto drainer label, but the low trust score and multiple blocklist entries confirm malicious intent. No further details about the site's visual content or backend scripts are available from this data.