app[.]mysubwallet[.]ng

The domain app.mysubwallet.ng is presently classified as an active crypto drainer with a risk level of under_investigation. DNS resolution directs traffic to the Cloudflare edge address 172.67.147.106, which is served by the authoritative nameservers algin.ns.cloudflare.com and wren.ns.cloudflare.com. The IP resides within the Cloudflare network (AS13335) and geolocates to the United States.

The only published page element is the title “Login | mySubwallet”, suggesting an attempt to harvest credentials associated with the mySubwallet service. TLS negotiation succeeds with a certificate issued by Google Trust Services under the WE1 authority, confirming that HTTPS is correctly provisioned. WHOIS data indicates the domain was created on 02 April 2025 and was registered through KWE Holding Limited.

Threat intelligence labels the site as a cryptocurrency scam, specifically a crypto drainer, which commonly seeks private keys or wallet access to illicitly transfer digital assets. The domain appears on a single security blocklist and has been flagged by the feed PhishDestroy. An HTTP 200 response confirms that the web server is actively delivering content. VirusTotal reports 0 detections out of 95 scans; this lack of detection does not constitute a safety assurance given the confirmed malicious classification.

Defensive teams should treat app.mysubwallet.ng as hostile infrastructure. Recommended actions include adding the domain to outbound firewall deny lists, enforcing web‑proxy rules to block both HTTP and HTTPS traffic to the associated IP, and monitoring DNS queries for the Cloudflare address for any anomalous spikes. Continuous threat‑intel monitoring is advised to capture potential changes in hosting, certificate renewal, or additional blocklist listings that could indicate escalation of the campaign.