shadewallet[.]xyz

On July 24, 2026, the domain shadewallet.xyz was observed hosting a malicious crypto‑drainer front‑end titled “Shade Wallet – USDT Multi‑Chain Wallet”. The site is currently offline, but historical data indicate that it was registered on 21 February 2026 through NameSilo, LLC. The authoritative name servers are chan.ns.cloudflare.com and pete.ns.cloudflare.com, both belonging to Cloudflare. DNS resolution points to the IP address 66.71.220.1, which is advertised as part of AS13335 Cloudflare, Inc. and geolocated in the United States. No TLS certificate was presented, meaning the site operated over plain HTTP, a characteristic often exploited to intercept credentials. Malware detection services on VirusTotal reported that five of ninety‑three scanners flagged the domain as malicious, reinforcing the suspicion of fraudulent activity.

Independent security tools further reduced confidence: Gridinsoft assigned a trust score of zero out of one hundred, and the domain appears on a single security blocklist. PhishDestroy has already added the host to its block list, indicating that at least one commercial mitigation service is actively preventing client access. The available evidence confirms the presence of a crypto‑drainer campaign targeting users of USDT across multiple chains. However, the exact phishing kit, the specific methods used to exfiltrate private keys, and any associated command‑and‑control infrastructure remain undocumented in the public data set.

Defenders should therefore treat any traffic to or from 66.71.220.1 as potentially hostile, enforce URL filtering against shadewallet.xyz, and block the domain at the DNS layer. Network monitoring for outbound connections to Cloudflare edge nodes associated with this IP can help identify compromised clients.