ddx[.]trade-connect-wallet[.]com

This domain, ddx.trade-connect-wallet.com, was registered on 2026-02-21 through Web Commerce Communications Limited and is currently hosted on Cloudflare infrastructure (AS13335, US). DNS resolution points to 172.67.132.227 and the authoritative name servers are amos.ns.cloudflare.com and summer.ns.cloudflare.com. The site presented a TLS certificate issued by Google Trust Services under the WE1 intermediate, confirming use of Cloudflare’s SSL termination. HTTP headers indicate support for HTTP/3, and the page title returned during the last check was “Page Not Found”, consistent with the domain being taken offline at the time of analysis.

Security aggregators have classified the domain as a crypto drainer. It appears on two public blocklists, specifically PhishDestroy and ScamSniffer, and VirusTotal recorded 11 positive detections out of 93 scanned scanners. No additional content or landing pages were observed, and the brief offline status prevents direct inspection of malicious payloads.

The evidence suggests the domain was prepared for a cryptocurrency theft campaign, likely employing a wallet‑generation or transaction‑relay component, but the exact tactics, techniques, and procedures remain unconfirmed. Defenders should block the domain and its resolving IP address at perimeter and DNS layers, monitor for re‑registration or resurrection of the host, and incorporate the observed indicators—certificate issuer, name servers, and detection signatures—into threat‑intel feeds. Continuous re‑scanning of the domain is recommended to capture any future activity.