checkmywallet[.]com

Analysis of checkmywallet.com shows a high‑risk crypto‑drainer infrastructure that remains active as of the report date, July 25, 2026. The domain was registered on February 21, 2026 through Dynadoc LLC and uses the nameservers ns5.afternic.com and ns6.afternic.com. The site presents a page title identical to the domain name, offering no additional context about its purpose. A Go Daddy Secure Certificate Authority – G2 TLS certificate is in place, and HTTP requests return a 200 status code, indicating that the web service is reachable and delivering content. Technical fingerprinting reveals a Node.js stack fronted by Envoy and Express, with HSTS enforcement and Akamai edge delivery.

The hosting IP resolves to the IPv6 address 2a02:26f0:480:59e::1771, which maps to the Akamai International B.V. network (AS20940) located in Germany. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist. VirusTotal scans report that 3 of 91 security vendors have flagged the domain, reinforcing the malicious classification. The domain is explicitly labeled as a "Crypto Scam" in the intelligence feed and is blocked by PhishDestroy.

MX records are present but empty, suggesting no email service is configured. While the exact payload or withdrawal mechanism has not been publicly disclosed, the convergence of low trust scoring, multiple vendor detections, and active blocking indicates a functional cryptocurrency theft operation. Defenders should block the domain at the DNS and proxy layers, add the IPv6 address to network‑level deny lists, and monitor outbound connections to Akamai nodes for anomalous traffic patterns. Continuous re‑scanning on VirusTotal and inclusion in internal threat intel feeds are recommended to capture any evolution of the campaign.