surfwalletdesktop[.]com

surfwalletdesktop.com is currently flagged as an active crypto‑drainer infrastructure. The domain was registered on May 30 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv4 address 203.188.171.156. Multiple protective services have taken action: PhishDestroy, MetaMask and SEAL list the domain as blocked, and it appears on three independent security blocklists. VirusTotal analysis shows that nine of ninety‑one scanned engines raise detections, indicating a non‑trivial malicious profile.

The elevated risk rating reflects the combination of recent creation, hosting on a single IP address, and corroborating blocklist entries. Public intelligence does not yet disclose SSL certificate details, HTTP response codes, or page‑title metadata, and no references to an OTX pulse or Safe Browsing entry have been observed. Consequently, the full payload or command‑and‑control behavior remains unverified, and the specific phishing landing page content has not been publicly captured. Defenders should incorporate the domain into deny‑list rules at network perimeters and endpoint filters, especially those protecting cryptocurrency wallet applications.

Continuous monitoring of the IP address 203.188.171.156 for additional domains or anomalous traffic is advised. Organizations using MetaMask or similar extensions should verify that their extension blocklists include this domain to prevent accidental credential capture. Because the registration information is recent, threat‑hunting teams should query WHOIS and passive DNS for any associated subdomains that may appear in the near term. Until further forensic detail emerges, the recommendation is to treat any communication originating from or referencing surfwalletdesktop.com as malicious and to block it at the earliest opportunity.