foldappdesktop[.]com

The domain foldappdesktop.com was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It is being used in a high‑risk brand‑impersonation campaign that mimics the Fold desktop wallet, presenting a page titled “Fold Desktop Wallet — Personal finance powered by Bitcoin.” The site returns an HTTP 308 permanent redirect, indicating intentional traffic steering. Technical infrastructure shows the domain is delegated to the Cloudflare nameservers frank.ns.cloudflare.com and nia.ns.cloudflare.com. DNS resolution points to IP address 216.150.1.1, which belongs to Vercel, Inc. and is geolocated in the United States. The site is secured with a Let’s Encrypt R12 certificate, confirming the use of a free TLS provider. No additional hosting clues are exposed beyond the Vercel association. Threat intelligence signals reinforce the malicious nature of the domain. It appears on one public security blocklist and has a Gridinsoft trust score of 0 out of 100. AlienVault OTX includes the domain in a single pulse, and VirusTotal reports that 2 of 95 scanned security vendors flagged the site. PhishDestroy has already blocked the domain, and the observed scam type is classified as a fake wallet designed to harvest credentials for the Fold brand. Defenders should immediately add foldappdesktop.com to URL filtering and DNS block lists, and consider sinkholing the resolved IP address 216.150.1.1 to disrupt traffic. Continuous monitoring of any newly observed C‑NAME or A‑record changes is advised, as the attacker may shift hosting providers while retaining the same domain. Users of the Fold service should be warned not to enter credentials on this site, and any reported incidents should be escalated to the appropriate brand‑abuse team.