xwalletssupport[.]com

Analysis of xwalletssupport.com shows a recently registered domain created on March 11 2026 that is presently taken offline. The domain resolves to IP 89.187.25.21, which belongs to the NL‑based network operated by Ultahost, Inc. (AS214036). All four authoritative name servers resolve to ns1‑ns4.ultahost.com, confirming the hosting provider. The TLS certificate presented is a staging‑only Let\'s Encrypt certificate signed by the Tenuous Tomato R13 intermediate, indicating a non‑production SSL deployment. The site advertised the page title "Credit Alert Sender", suggesting an attempt to lure victims with a fraudulent credit‑related notification.

Technology fingerprints include Zoho services, Tailwind CSS styling, LiteSpeed web server and HTTP/3 support, a stack commonly observed in opportunistic scam pages. VirusTotal records show that two of ninety‑five security scanners flagged the domain, providing additional confirmation of malicious intent. The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy feed, which classifies it as a crypto‑drainer scam. Registration was performed through Dynadot LLC, a registrar that does not impose additional privacy shields.

No further public content has been captured because the host is offline, so the exact content, form fields, or credential‑capture mechanisms remain unknown. Defensive teams should add the domain and its resolving IP address to their deny lists, monitor for any future DNS reactivation, and watch for sister domains using the same name‑server set or similar technology stack. Threat‑intelligence platforms should correlate this indicator with other crypto‑drainer campaigns, and SOC analysts should flag any outbound traffic to 89.187.25.21 as suspicious. Continued observation of the Ultahost hosting range is recommended to detect potential re‑use of the same infrastructure.