walletchat[.]fun

walletchat.fun is an active crypto‑drainer site observed on July 24 2026. The domain was registered on 21 February 2026 through NameCheap, Inc. and resolves to the IP address 198.202.211.1, which is part of AS209242 Cloudflare London, LLC and located in the United States. DNS is served by dns1.registrar‑servers.com and dns2.registrar‑servers.com. TLS termination uses a Google Trust Services certificate issued to WE1, indicating a valid HTTPS service. An HTTP GET returns status 200, and the page title reported by passive scanners is “WalletChat – Wallet to Wallet messaging chat for web3”, matching the declared scam type of a crypto scam. The site loads third‑party resources from Twitter, Google Hosted Libraries, Google Font API, Google Analytics, and Cloudflare, with HTTP/3 enabled.

Infrastructure analysis shows the domain appears on one security blocklist and has a Gridinsoft trust score of 0 / 100, underscoring its malicious reputation. VirusTotal analysis reports three of ninety‑three scanning engines flagging the domain, providing additional confirmation of malicious activity. The MX record list includes an entry for aspmx.l.google.com (priority 1) and alt2.as (truncated), suggesting a Gmail‑based mail service is configured, which may be used for phishing communications. The domain is also listed as blocked by PhishDestroy. Evidence confirms the site is being used to lure cryptocurrency users into transferring funds, consistent with the “crypto drainer” classification.

However, no public samples of the malicious payload or detailed phishing flow have been published, leaving the exact social‑engineering tactics and victim interaction unknown. Defenders should block the domain at perimeter firewalls and DNS resolvers, monitor outbound connections to the associated IP, and enforce TLS inspection to detect any credential exfiltration attempts.