mytonwallet[.]info

The domain mytonwallet.info was registered on November 28, 2025 through OVH SAS and is currently listed as offline. DNS resolution points to the IPv6 address 2001:41d0:301::100, which is owned by OVH SAS in France (AS16276). The domain uses the standard OVH nameservers ns16.ovh.net and dns16.ovh.net, and serves an HTTPS certificate issued by Let’s Encrypt (E8). A simple HTTP request returned a 200 status code with the page title "Index of /," indicating an empty directory listing rather than a custom landing page.

The site appears on a single security blocklist, PhishDestroy, and is flagged by eight of ninety-five VirusTotal scanners, reflecting a modest but notable detection rate. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment that the domain is malicious. The reported scam type is a crypto scam, specifically a crypto drainer, suggesting that the domain was intended to lure cryptocurrency users into disclosing private keys or sending funds to fraudulent wallets.

No additional content analysis or malware payload information is available, leaving the exact phishing flow and victim interaction unknown. Defenders should continue to block the domain at network perimeter devices, update DNS blacklists with the IPv6 address, and monitor for any resurgence of the site. Given the low trust score and existing blocklist entry, proactive containment is advised, and any future resolution of the domain should be treated as high‑risk until further forensic evidence is gathered.