metawallet[.]asia

Analysis of the domain metawallet.asia, observed on July 23, 2026, indicates that it was used to host a crypto‑drainer campaign leveraging an Airdrop Scam kit. The site presented the page title “Top Crypto Airdrops,” a common lure for users seeking free tokens, and was classified by threat intel as a Crypto Scam. The domain was registered on November 23, 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.184.15 located in the United States. DNS resolution points to Cloudflare name servers crystal.ns.cloudflare.com and sergi.ns.cloudflare.com.

No TLS certificate was observed, meaning the site operated without HTTPS encryption, which further lowers trustworthiness. Security‑vendor scans on VirusTotal recorded 15 detections out of 95 scanners, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming its recognition by at least one anti‑phishing service. Current online status is offline, suggesting the operators have taken the site down, but the underlying infrastructure—Cloudflare IP space and the registrar—remains reusable for future campaigns.

Defenders should continue to monitor the IP 172.67.184.15 and associated Cloudflare ranges for re‑activation, enforce outbound traffic controls to block connections to this domain and any newly resolved subdomains, and update URL filtering policies with the exact domain name. Because the site lacked SSL, any attempt to communicate over HTTP could be intercepted, offering an additional mitigation vector. Organizations should educate users about unsolicited crypto airdrop offers and advise them to verify URLs before interacting with any wallet‑related services. The combination of multiple vendor detections, a zero trust score, and blocklist presence underscores the elevated risk associated with this infrastructure.