shop[.]hardwarewallet[.]jp

Analysis of shop.hardwarewallet.jp indicates active infrastructure supporting a high‑risk crypto drainer campaign. The domain was registered on April 08, 2026 and resolves to 104.18.12.81, an IP address assigned to Cloudflare, Inc. in Canada. DNS resolution is handled by dns01.muumuu-domain.com and dns02.muumuu-domain.com. The web server returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (E7). The page title observed is "ハードウェアウォレット", confirming a wallet‑related theme consistent with the classified scam type of Wallet/Seed Phishing. Security scanning on VirusTotal recorded a single detection out of 94 vendors, and the domain appears on one external blocklist. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already blocked the host. The limited detection footprint suggests the site may be newly deployed or employing evasion techniques, but the combination of a suspicious title, low trust score, and a single vendor flag is sufficient to label the domain as a malicious actor targeting cryptocurrency users. Defenders should add shop.hardwarewallet.jp to URL filtering and sinkhole lists, monitor traffic for connections to the associated Cloudflare IP, and educate users about unsolicited wallet‑seed requests. Further forensic capture of the site’s content is recommended to enrich attribution and to confirm any additional payloads or credential‑harvesting mechanisms.