wallet[.]validator[.]test[.]canton[.]obsidian[.]systems

The domain wallet.validator.test.canton.obsidian.systems was registered on May 16 2026 through NameCheap, Inc. It resolves to the public IPv4 address 52.1.44.192, which belongs to an Amazon Web Services EC2 instance in the us‑east‑1 region. The hosting infrastructure is typical for short‑lived malicious deployments, leveraging AWS’s global DNS and compute resources to obtain a readily reachable endpoint. Infrastructure analysis shows the domain is delegated to four Amazon Route 53 name servers: ns-1861.awsdns-40.co.uk, ns-391.awsdns-48.com, ns-1084.awsdns-07.org, and a fourth entry truncated in the source data. The web server returns HTTP 200 for default requests and presents an Amazon‑issued RSA 2048‑M01 certificate, confirming the use of AWS Certificate Manager. Gridinsoft’s trust scoring assigns a rating of 0 / 100, indicating a reputation of extreme distrust. Threat intelligence classifies the site as a crypto‑drainer, a pattern that typically lures cryptocurrency wallet users into submitting private keys or signing malicious transactions. The domain appears on a single security blocklist and is currently blocked by PhishDestroy. VirusTotal analysis records a single positive detection out of 95 scanners, reinforcing the low‑visibility but high‑risk nature of the operation. The combination of a fresh registration, zero trust score, and a valid SSL certificate is consistent with a fast‑flux style fraud campaign. Defenders should add wallet.validator.test.canton.obsidian.systems to DNS blocklists and enforce outbound filtering for connections to the 52.1.44.192 address. Network telemetry should be inspected for anomalous HTTP 200 responses from the AWS region, and any credential submission to the domain must be treated as compromise. Continuous monitoring of the associated name servers is advised, as the attacker may shift the underlying IP address while retaining the same domain registration.