checkwallet[.]vip

Analysis of checkwallet.vip indicates a high‑confidence crypto‑drainer profile despite the site being taken offline at the time of assessment. The domain resolves to the Cloudflare‑managed address 104.21.80.236, which is geolocated to Canada and served through Cloudflare’s infrastructure, including HTTP/3 support and a Vue.js front‑end framework. No TLS certificate is presented, meaning the site operated without HTTPS, a common characteristic of malicious drop‑sites that rely on rapid content changes. The page title returned by the server is "AML Bot," offering no legitimate business context and reinforcing the suspicion of automated or deceptive behavior.

The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, and the domain was registered on March 22 2026, suggesting a short lifespan typical of abuse‑focused domains. Gridinsoft’s trust scoring assigns a zero out of one hundred, reflecting an extremely poor reputation. Security‑vendor intelligence from VirusTotal shows that 14 of 94 scanners flagged the domain, and it appears on a single blocklist, specifically PhishDestroy, confirming at least one external party has identified it as malicious. Nameservers henry.ns.cloudflare.com and kenia.ns.cloudflare.com further confirm reliance on Cloudflare DNS services.

The combination of a crypto‑scam classification, lack of encryption, low trust score, and multiple vendor detections provides concrete evidence that the domain was used to lure victims into exposing cryptocurrency credentials. Uncertainty remains regarding the exact payload delivered, as the site content was not captured before takedown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the IP address or associated Cloudflare zones, and update detection signatures to include the observed page title and infrastructure fingerprints.