mydotwallet[.]com

Analysis of mydotwallet.com, registered through GoDaddy.com, LLC on September 06, 2022, shows a high‑risk infrastructure designed to impersonate the Ethereum brand. The site presents a page title of "MyDotWallet: Polkadot Staking, and Crowdloans," yet it advertises services that appear unrelated to the legitimate Polkadot ecosystem, indicating a deliberate brand‑confusion tactic. The domain resolves to IP address 185.199.109.153, which belongs to AS54113 Fastly, Inc. in the United States, and the hosting stack includes Varnish, Fastly CDN, and GitHub Pages serving Vue.js content. A valid Let’s Encrypt R12 certificate and HTTP 301 redirection are observed, but the presence of HSTS suggests intent to maintain persistent HTTPS connections for credential harvesting.

Security assessments assign a Gridinsoft trust score of 0 / 100, and the domain appears on four independent blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura). VirusTotal reports that four out of ninety‑three scanners flag the domain, reinforcing the malicious classification. The site is currently active, and its nameservers (ns69.domaincontrol.com, ns70.domaincontrol.com) are typical of GoDaddy‑managed domains, providing no additional concealment.

While the exact phishing page content has not been examined, the combination of brand impersonation, crypto‑focused scam type, low trust scores, multiple blocklist entries, and partial VirusTotal detections offers strong evidence of a coordinated crypto‑scam operation. Defenders should block the domain at network perimeter, monitor DNS queries for the associated nameservers, and add the IP address to threat‑intel feeds. Further investigation of the hosted content is advised to identify any credential‑capture forms or malicious payloads, and affected users should be warned to avoid interacting with any services claiming affiliation with Ethereum or Polkadot hosted on this domain.