walletpay[.]icu

PhishDestroy identifies walletpay.icu as a high-risk crypto-draining domain designed to trick users into unknowingly transferring cryptocurrency to threat actor wallets. Upon visiting, the site may display fake wallet interfaces or transaction confirmations to deceive victims into approving fraudulent transfers. This threat is particularly dangerous because it operates silently in the background, leveraging fake SSL certificates and deceptive domain names to appear legitimate. Users who authorize transactions may only realize the fraud after discovering unauthorized crypto withdrawals from their wallets, often with irreversible losses due to blockchain transaction finality.

This domain was flagged due to its active crypto-drainer operations and suspicious infrastructure. It was registered on April 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often abused by malicious actors for short-lived domains. The domain resolves to IP address 104.21.16.171 and currently shows 0 detections out of 95 scans on VirusTotal, indicating it evades immediate detection by antivirus engines. Its Let's Encrypt SSL certificate adds to its deceptive appearance, mimicking legitimate services to gain user trust.

If you visited walletpay.icu, immediately revoke any wallet connection permissions it may have obtained. Check your wallet’s connected apps and dApps, and disconnect any unknown or suspicious integrations. Verify the site’s authenticity using PhishDestroy’s verification tools before entering any personal or financial information. Report the domain to your wallet provider and local cybercrime units, including transaction hashes and wallet addresses involved in any unauthorized transfers. Stay vigilant by double-checking URLs, using hardware wallets for sensitive operations, and installing crypto-specific security extensions that detect drainer scripts.