wallnetsync[.]live

wallnetsync.live entered the PhishDestroy evidence set on Feb 2, 2026. The stored content classification is wallet/seed phishing. The assembled evidence scores 79/100 (high).

Five independent sources are positive: VirusTotal, Polkadot, Enkrypt, Codeesura, and URLQuery. VirusTotal recorded 4 detections among 95 engines: Ermes, Gridinsoft, Seclookup, SOCRadar on Feb 22, 2026 at 02:03 UTC. Polkadot, Enkrypt, and Codeesura listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. URLQuery recorded 1 threat-system alert on Feb 2, 2026 at 13:53 UTC. The evidence is not unanimous. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Mar 28, 2026 at 12:44 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:28 UTC; content was unavailable. Registration records for the domain list Ultahost, Inc. as the registrar. At collection time, the hostname resolved to 159.100.6.19 on AS214036 (ULTAHOST-AS Ultahost, Inc., US). The associated network metadata labels the endpoint as AS214036 Ultahost, Inc. in Frankfurt am Main, DE. The stored server header is LiteSpeed. Captured page title: “Wall Net Sync”. DOM analysis completed on Apr 23, 2026 at 07:21 UTC; stored DOM score 5/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Aug 2, 2026 at 04:14 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as wallet/seed phishing.