whitewalletlist[.]top

This domain, whitewalletlist.top, was observed actively serving a crypto‑scam page titled “AML Check” that pretends to be associated with the CS:GO brand. The domain was registered on 21 February 2026 through Web Commerce Communications Limited and points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution uses the Cloudflare nameservers hugh.ns.cloudflare.com and itzel.ns.cloudflare.com. No TLS certificate is presented, and the site returns no HTTPS response.

VirusTotal scans show six of ninety‑three security vendors flagging the domain as malicious, and the host is listed on four external blocklists. Commercial blocklist providers PhishDestroy, Polkadot, Enkrypt and Codeesura have also marked the domain as hostile. The infrastructure is currently offline, so active probing is not possible, but the historical evidence confirms a pattern of brand impersonation aimed at CS:GO users and a crypto‑draining campaign, as indicated by the “AML Check” page title and the classification as a crypto scam.

Uncertainty remains regarding the exact attack flow, such as whether credential harvesting or wallet address substitution was used, because the live page content has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, add 188.114.96.3 to IP‑based deny lists, and monitor for any re‑registration attempts or similar Cloudflare‑hosted domains that reference CS:GO or crypto‑related terminology. Threat intel feeds that reference the six VirusTotal detections and the four blocklist entries should be updated to reflect the confirmed malicious status of whitewalletlist.top.