walletrescueservice[.]com

walletrescueservice.com was registered on February 21, 2026 through One.com A/S and uses Cloudflare nameservers peter.ns.cloudflare.com and rihana.ns.cloudflare.com. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. TLS is provided by a Google Trust Services certificate issued to the WE1 organization, confirming the use of a valid SSL chain. An HTTP GET returns status code 200 and the page title "Wallet Recovery Service - WRS", matching the reported scam type of a crypto scam that employs the publicly identified "Recovery Scam" kit.

The site is currently listed on at least one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment. The combination of recent registration, Cloudflare hosting, low trust score, and detection by multiple independent sources demonstrates that the infrastructure is actively being used to lure cryptocurrency users into a recovery‑drain operation.

At this time no additional technical artefacts such as malware payloads or command‑and‑control endpoints have been observed, so the full scope of the campaign remains uncertain. Defenders should block the domain at network perimeter, add it to URL filtering and sink‑hole lists, monitor for outbound connections to the Cloudflare IP, and consider notifying the registrar One.com A/S for takedown. Continuous re‑evaluation is advised as further indicators may emerge.