walletcheck[.]digital

This domain, walletcheck.digital, is flagged as an active cryptocurrency phishing site targeting users with a crypto drainer scheme. Registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains operational as of July 12, 2026, with a confirmed HTTP 200 status. Analysis of its infrastructure reveals it resolves to the IP address 135.125.128.255, hosted on AS16276 (OVH SAS) in Germany. The domain employs nameservers dns1.regway.com, dns2.regway.com, dns3.regway.com, and dns4.regway.com, a configuration commonly observed in phishing operations due to its resilience and redundancy. The page title, Report-USDT Bot, suggests the site is designed to deceive users into interacting with a fraudulent USDT (Tether) bot, likely intended to drain cryptocurrency from connected wallets. Security vendors have begun flagging the domain, with 2 out of 95 engines on VirusTotal identifying it as malicious, and it appears on four independent security blocklists. The domain’s SSL certificate, issued by Let’s Encrypt, provides encryption but does not validate the legitimacy of the site, a tactic frequently exploited by threat actors to lend a false sense of security to visitors. While the exact mechanics of the drainer remain unconfirmed due to the absence of direct analysis of the site’s content, the combination of its registration details, hosting infrastructure, and security flags strongly indicates malicious intent. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Organizations should also monitor for connections to 135.125.128.255 and the associated nameservers, as these may serve additional phishing or malware distribution campaigns. Given the domain’s recent creation and active status, further monitoring is recommended to track any shifts in its infrastructure or targeting patterns.