protonwalletdesktop[.]com

Analysis of the domain protonwalletdesktop.com shows a newly registered site that was created on February 21, 2026 and is currently taken offline. The domain resolves to the IP address 64.29.17.65, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the use of Vercel’s DNS service for hosting. No TLS certificate is presented, leaving the site without transport‑level encryption and making it vulnerable to interception. The page title returned by the server is "Proton Desktop Wallet," suggesting an attempt to masquerade as an official Proton wallet application, and the threat type is classified as a crypto scam or crypto drainer.

The domain appears on one security blocklist and is listed as blocked by PhishDestroy. Gridinsoft assigns a trust score of 1 out of 100, reflecting extremely low confidence in the site’s legitimacy. VirusTotal has recorded 14 detections out of 93 scanning engines, reinforcing the malicious assessment. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not provide additional reputation signals.

While the available evidence confirms infrastructure that is typical of malicious crypto‑draining operations—such as a low‑reputation score, lack of SSL, and multiple vendor detections—the exact payload or credential‑stealing mechanisms have not been publicly disclosed, leaving the functional details of the drainer uncertain. Defenders should add the domain and its resolving IP to blocklists, enforce DNS filtering, and monitor outbound connections to the Amazon‑hosted address. Network sensors should flag any attempts to contact the domain, especially from systems handling cryptocurrency wallets, and incident response teams should treat any credentials or private keys associated with Proton services as potentially compromised.