ctrldesktop[.]xyz

The domain ctrldesktop.xyz was registered on February 21, 2026 through Tucows Domains Inc. and is currently listed as offline. The site presents the page title “Ctrl Wallet”, indicating a cryptocurrency‑wallet impersonation consistent with the observed “Crypto Scam” classification. No TLS certificate is associated with the host, confirming that the service was delivered over plain HTTP when it was reachable. DNS resolution points to the Cloudflare edge address 188.114.96.3, an IP owned by AS13335 Cloudflare, Inc. in the United States. The domain is served by the Cloudflare authoritative name servers melinda.ns.cloudflare.com and uriah.ns.cloudflare.com, a configuration commonly shared among many unrelated legitimate sites, which reduces the discriminative value of the hosting alone.

Threat intelligence sources flag the domain on a single external blocklist and it is explicitly blocked by the PhishDestroy service. The Open Threat Exchange records a single pulse referencing the domain, reinforcing its association with malicious activity. VirusTotal scans returned detections from 12 of 93 security vendors, providing independent confirmation of its malicious nature. No additional evidence such as Safe Browsing status or further community reports is available.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms that may have been hosted at the URL, as the site is no longer reachable for direct analysis. Consequently, defenders should treat the domain as a confirmed malicious indicator. Recommended actions include adding ctrldesktop.xyz to DNS and proxy deny lists, enforcing block policies on the associated IP 188.114.96.3, and monitoring for newly registered domains that resolve to the same Cloudflare edge nodes or reuse the same registrar. Continuous ingestion of updated threat feeds will help capture any resurgence of the campaign or related infrastructure.