walletsblockchain[.]netlify[.]app

The domain walletsblockchain.netlify.app has been identified as an active crypto drainer platform. Infrastructure analysis shows the hostname resolves to the IPv4 address 63.176.8.218, which is part of Netlify’s hosting environment. The domain was originally registered on May 08, 2018 through Netlify and has persisted for several years, indicating a stable foothold. Reputation services have flagged the site: Google Safe Browsing classifies it as social engineering, and three independent security blocklists currently list the domain.

VirusTotal reports that 10 of 91 scanned security vendors have raised detections against the host, confirming malicious behavior. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have explicitly blocked the domain, reinforcing the consensus that it is being used to illicitly acquire cryptocurrency assets. The threat is catalogued as a crypto drainer, and the risk level is assessed as high. While the exact phishing page content and harvest mechanisms have not been publicly disclosed, the convergence of multiple detections across vendor feeds and blocklists provides strong confidence that the site is engaged in credential or private‑key theft aimed at crypto wallets.

Defenders should add the domain and its resolving IP to deny‑list rules across firewalls, DNS filters, and endpoint protection suites. Monitoring for outbound connections to 63.176.8.218 and related Netlify sub‑domains is recommended. Organizations should also educate users about unsolicited wallet‑related URLs, especially those leveraging the “walletsblockchain” naming pattern, and enforce multi‑factor authentication for wallet access. Continuous threat‑intel feeds should be consulted for any updates on the infrastructure, including potential shifts to new hosting endpoints.