walletcheck[.]co

This domain, www.walletcheck.co, is identified as a crypto drainer phishing site designed to compromise cryptocurrency wallets under the guise of AML blockchain verification. The page title, 'WalletCheck — AML Blockchain Verification,' suggests an attempt to mimic legitimate compliance checks, a common tactic to deceive users into connecting their wallets. No explicit brand impersonation is observed, but the infrastructure aligns with known crypto drainer kits that exploit web3 authentication flows to siphon funds. Analysis of the domain reveals no direct affiliation with established blockchain services, reinforcing its malicious intent.

Infrastructure analysis reveals the following technical indicators: the domain was registered on April 21, 2026, through Hello Internet Corp 8, a registrar frequently associated with high-risk domains. It resolves to the IP address 64.29.17.1, which has been linked to other phishing campaigns. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, indicating limited but targeted detection. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation.

As of the latest assessment, www.walletcheck.co has been taken down, reducing immediate exposure to users. However, the infrastructure may persist in cached or mirrored forms, and the registrar’s history suggests potential for re-emergence under similar domains. Users who interacted with the site should revoke wallet permissions, monitor transactions for unauthorized activity, and verify future interactions with blockchain services through official channels only. The elevated risk level is retained due to the domain’s recent activity and the irreversible nature of cryptocurrency theft.