plinkwallet[.]app

Analysis of plinkwallet.app as of July 24, 2026 shows a newly‑registered domain created on 21 February 2026 that is actively being used in a crypto‑drainer campaign. The domain is registered through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 104.21.72.120, which belongs to ASN 13335 (Cloudflare, Inc.) in the United States. DNS is served by decker.ns.cloudflare.com and dina.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating that TLS termination is handled by Cloudflare. HTTP requests return status code 521, a Cloudflare‑specific response that typically signals that the origin server is unreachable, a pattern often observed in malicious infrastructure that relies on Cloudflare as a front‑end shield. Threat intelligence sources have classified the site as a Crypto Scam with a specific focus on draining cryptocurrency wallets.

Three of ninety‑five VirusTotal scanners flagged the domain, and it appears on one external blocklist. PhishDestroy has also added the domain to its blocklist, confirming that security‑focused organizations consider it malicious. Detected technologies include Cloudflare and HTTP/3, which are consistent with the observed infrastructure. While the page title “Plink Wallet” is the only content‑level indicator available, no further content analysis has been published, leaving the exact user‑facing payload unknown.

The combination of a recent registration, Cloudflare fronting, a valid TLS certificate, and multiple vendor detections strongly suggests an active operation rather than a benign site. Defenders should block DNS resolution for plinkwallet.app at the network perimeter, add the domain to web‑filtering and endpoint allow‑lists, and monitor outbound traffic for connections to 104.21.72.120. Additional sandbox analysis of any downloaded payloads or URLs referenced from the site is advised.