walletyeet[.]patch-demon115[.]workers[.]dev

This domain, walletyeet.patch-demon115.workers.dev, is actively engaged in crypto drainer phishing operations targeting cryptocurrency wallet users. The site presents itself as a "One signature wallet migration" service under the page title "1sign · One signature wallet migration," likely impersonating legitimate wallet migration or authentication platforms. Analysis indicates the domain is designed to trick users into authorizing malicious transactions that drain funds from connected wallets, a tactic commonly associated with high-risk crypto drainer schemes. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Let’s Encrypt (serial number E7). It resolves to the IP address 188.114.96.3 and was created on June 15, 2026, though its recent activity suggests it may be part of an ongoing campaign. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal, while it appears on two independent security blocklists. Additional tracking confirms it is currently blocked by PhishDestroy and ScamSniffer, further validating its malicious classification. The low vendor detection rate may indicate evasion techniques or the use of newly deployed infrastructure. The domain remains active as of this report, posing a significant risk to users who may interact with it. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its associated IP address. Endpoint protection systems should be updated to detect and prevent access to walletyeet.patch-demon115.workers.dev. Users who may have interacted with the site should revoke any connected wallet authorizations, review transaction histories for unauthorized activity, and consider migrating funds to a new wallet if compromise is suspected. Continuous monitoring of related infrastructure is recommended, as threat actors frequently rotate domains and IPs in crypto drainer campaigns.