walletarmor[.]org

This domain, walletarmor.org, operates as a crypto drainer, a specialized form of phishing infrastructure designed to deplete cryptocurrency wallets by tricking users into executing malicious transactions. The site masquerades as an on-chain security scanner under the page title 'WalletArmor — On-Chain Security Scanner,' leveraging false legitimacy to prompt victims into connecting their wallets. Once connected, the drainer silently siphons assets through unauthorized smart contract interactions, often bypassing basic security checks by exploiting user trust in security-themed interfaces. Infrastructure analysis reveals multiple red flags corroborating its malicious nature. The domain was registered on May 30, 2026, through Spaceship, Inc., a registrar with historical associations to fraudulent domains. Detection metrics show limited but targeted flagging, with 2 out of 95 security vendors on VirusTotal identifying it as malicious. Additionally, the domain appears on two independent security blocklists and is actively blocked by specialized cryptocurrency fraud detection systems. The discrepancy between the creation date (2026) and current activity suggests possible domain spoofing or registry manipulation to evade temporal-based detection. Users who have interacted with walletarmor.org should immediately revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet. All transactions initiated through this domain should be treated as compromised, and victims are advised to audit their wallet activity for unauthorized transfers. If credentials or private keys were entered, consider the wallet fully compromised and cease all use. Security teams should update blocklists to include this domain and monitor for related infrastructure, such as associated IP addresses or subdomains, which may emerge as part of the same campaign.