subwalletdesktop[.]com

Analysis of subwalletdesktop.com indicates a confirmed wallet seed phishing operation impersonating the Across protocol, active as of July 24, 2026. The domain was registered on February 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site was taken offline following detection by multiple security vendors, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and its presence on four security blocklists. The page title, 'SubWallet Desktop - Your Multichain Command Center | Download Now,' aligns with known phishing tactics targeting cryptocurrency wallet users, specifically those interacting with multichain platforms.

VirusTotal scans flagged the domain as malicious, with 9 of 93 security vendors marking it as a threat. Gridinsoft and Scamadviser assigned trust scores of 0/100 and 10/100, respectively, further corroborating its fraudulent nature. The SSL certificate, issued under the R12 root, provides no additional trust signals, as phishing domains commonly use valid but low-assurance certificates. No evidence of Safe Browsing or OTX listings was provided, though the domain’s inclusion on multiple blocklists suggests prior detection by enterprise security tools.

Defenders should treat subwalletdesktop.com as a confirmed phishing asset. Indicators of compromise include the domain itself, its registrar, and the page title, which may be used to identify related campaigns. Organizations should update blocklists, monitor for residual traffic, and alert users who may have interacted with the domain prior to its takedown. While the site is currently offline, historical DNS records and SSL certificate data may assist in tracking infrastructure reuse by the same threat actors.