platinumwallet[.]net

On 24 November 2025 the domain platinumwallet.net was registered through Tucows Domains Inc. and currently resolves to the Cloudflare‑owned address 172.67.216.83 (AS13335, United States). The site presents a page titled “Platinum Wallet – Power Your Finances with Strength and Security” and is catalogued as a wallet/seed phishing campaign that impersonates the Curve brand. Infrastructure analysis shows the domain is served behind Cloudflare, with HSTS, HTTP/3 and Cloudflare Browser Insights enabled, and uses Google Trust Services / WE1 for TLS. MX records point to mx‑forward.smtpserver.com with priority 0, and the authoritative nameservers are ali.ns.cloudflare.com and seth.ns.cloudflare.com.

VirusTotal scans have recorded detections from 2 of 93 security vendors, and the domain is listed on one public blocklist. PhishDestroy has already blocked the site, and the Gridinsoft trust score is 7 out of 100, reflecting a low reputation. HTTP requests return a 200 OK status, indicating the site is live and actively serving content. The current risk rating is high and the status remains active.

Uncertainties remain regarding the exact phishing workflow, the presence of credential‑collection forms, and any additional command‑and‑control infrastructure, as no visual analysis of the page content is available. Defenders should add platinumwallet.net to blocklists, enforce DNS‑level filtering, monitor outbound connections to the Cloudflare IP range, and treat any credential or seed submissions associated with Curve as compromised. Continuous monitoring of VirusTotal, threat‑intel feeds, and the domain’s MX traffic is recommended to detect potential escalation or credential exfiltration.