wallet-sleuth--crypto-wallet-sleuth[.]us-central1[.]hosted[.]app

PhishDestroy identifies wallet-sleuth--crypto-wallet-sleuth.us-central1.hosted.app as an active crypto drainer domain currently under investigation (unique seed 322e3f). The page impersonates legitimate wallet-sleuthing tools to trick users into connecting their wallets and granting malicious token approvals. No publicly documented drainer kit payload has been extracted yet, but the site’s structure follows known JavaScript-based drainer patterns designed to execute unauthorized transfers upon wallet signature requests.

This domain was flagged by PhishDestroy with a VirusTotal score of 1/95 detections and resolves to IP 35.219.200.29 in Google Cloud’s us-central1 region. The SSL certificate is issued by Google Trust Services, adding superficial legitimacy. Creation date and registrar details remain obscured due to Google’s hosting abstraction, but WHOIS shows a recent registration under a privacy-protected Google Cloud entity. The domain has not yet been listed on major blocklists including Google Safe Browsing (GSB) or PhishTank, leaving end-users vulnerable during this detection lag.

Current status is active with an under_investigation risk level, indicating early-stage analysis without full behavioral capture. No takedown has been issued due to the legitimate Google hosting infrastructure, complicating removal. Users are advised to avoid visiting or interacting with any links referencing this domain, especially wallet connection prompts. To reduce exposure, block the IP 35.219.200.29 at network firewalls and report suspicious domains immediately to PhishDestroy or local CERT teams. Remaining risk is assessed as high during the investigation window due to zero detections and active hosting on trusted infrastructure.