walletauthconnect[.]com

walletauthconnect.com was registered on 21 February 2026 through Tucows Domains Inc. The domain resolves to IP 145.223.77.205, which is hosted by Hostinger International Limited in the United States (AS47583). Nameserver delegation points to cdns1.interserver.net and cdns2.interserver.net. No TLS certificate is presented, indicating the site is served without HTTPS. The site’s HTML title is “Wallet Auth Validator – | Connect Wallet”, consistent with a crypto‑related credential‑harvesting operation.

Google Safe Browsing classifies the URL as a social‑engineering threat and a single security blocklist has already listed the domain. VirusTotal scans show that 14 of 95 security engines flagged the domain, reinforcing its malicious reputation. The domain has been taken offline and is currently blocked by the PhishDestroy sinkhole, confirming that active mitigation is in place. The available intelligence points to a crypto drainer campaign that likely attempts to steal cryptocurrency wallet credentials by masquerading as a legitimate wallet authentication step.

Uncertainty remains regarding the exact phishing kit used, the specific cryptocurrency platforms targeted, and whether any victim data was exfiltrated before takedown. Defenders should add the IP address 145.223.77.205 and the domain name to network‑level deny lists, monitor for any residual traffic to the InterServer name servers, and enforce TLS inspection to capture any future attempts to host similar content on the same infrastructure. Continuous re‑query of public blocklists and VirusTotal for re‑appearance is recommended, as threat actors often repurpose compromised hosting accounts. Organizations that handle cryptocurrency transactions should educate users about unsolicited wallet‑validation requests and enforce multi‑factor authentication to reduce the impact of credential‑theft attempts.