cryptousawallet[.]com

cryptousawallet.com was registered on 21 February 2026 through BigRock Solutions Ltd. The domain resolves to the AWS CloudFront address 18.165.140.39, which is geolocated to Finland. The hosting provider is Amazon Web Services, indicating a globally distributed CDN infrastructure that can mask the true origin of malicious payloads. The domain’s authoritative nameservers are listed as ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-, suggesting the registrar placed the domain in a verification‑hold state prior to takedown. As of the reporting date, the site is offline.

VirusTotal scans have flagged 14 of 93 security vendors as positive, confirming that a non‑trivial portion of the scanning community detects malicious activity associated with the domain. The domain is present on four independent security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX includes the domain in a single threat‑intelligence pulse, further corroborating its association with illicit activity. The only classified threat category in the intelligence set is “Crypto Scam”, and the report’s risk level is high, identifying the domain as a crypto drainer.

No public page title or SSL certificate details are available, and the offline status prevents live content analysis; therefore, the precise mechanics of the drainer (e.g., whether it redirects to a malicious smart‑contract or harvests private keys) remain unknown. Defenders should immediately add cryptousawallet.com to URL filtering and DNS blocklists, enforce outbound traffic monitoring to the associated IP address 18.165.140.39, and watch for other domains hosted on the same AWS CloudFront edge nodes. Continuous hunting for similar registration patterns—BigRock registrar, verification‑hold nameservers, and rapid creation dates—can aid in early detection of future crypto‑drainer campaigns.