ufa789wallet[.]vip

This domain, ufa789wallet.vip, is flagged as an active crypto drainer site with high-risk indicators. Registered on October 10, 2025, through Spaceship, Inc., the domain remains operational as of July 12, 2026, returning an HTTP 200 status. Infrastructure analysis reveals it resolves to IP 188.114.96.3, hosted on Cloudflare’s network (AS13335) with nameservers elijah.ns.cloudflare.com and jean.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains, offering no definitive classification on its own. The domain appears on one security blocklist and is detected by 14 out of 95 security vendors on VirusTotal, indicating moderate but not universal consensus on its malicious nature. Google Safe Browsing explicitly flags it for social engineering, aligning with the reported scam type of cryptocurrency fraud. The page title, 'welcom-welcom,' provides no clear indication of a targeted brand or service, and no additional content analysis has been conducted to confirm specific lures or tactics. AlienVault OTX includes the domain in one threat intelligence pulse, suggesting prior detection in operational threat feeds. Defenders should treat this domain as a confirmed crypto drainer based on available intelligence. The use of Cloudflare and HSTS may complicate takedown efforts or investigative analysis, but the domain’s presence on blocklists and its association with known malicious infrastructure warrant immediate blocking at the network and endpoint levels. Monitoring for connections to 188.114.96.3 or the listed nameservers may help identify compromised systems interacting with this threat. No evidence suggests this domain is part of a broader campaign, but its active status and consistent detections indicate it remains a viable risk.