base.walletportal.online

VirusTotal analysis returned 12 positive detections out of 93 scanned security vendors, reinforcing the malicious assessment. The domain is also listed by the PhishDestroy blocklist, which specifically tags it as a brand‑impersonation vector. No additional intelligence such as Safe Browsing, OTX, or registrar details is available beyond the creation date and IP information. Given the limited but consistent indicators—brand‑targeted page title, multiple vendor detections, blocklist inclusion, and the hosting of an SSL‑protected site on a known South African IP—the infrastructure is likely being leveraged to harvest credentials or lure victims into crypto‑related fraud.

The offline status suggests the operators may be rotating hosts, a common tactic to evade takedown. Defenders should continue to block traffic to base.walletportal.online at perimeter devices, monitor outbound connections to the associated IP address, and add the domain to internal phishing‑filter lists. Threat‑hunters may query historical DNS and certificate transparency logs to identify any previous resolutions or related domains that share the same IP or certificate fingerprint.