webauthwallet[.]org

The domain webauthwallet.org is currently active and is associated with a high-risk crypto drainer threat. This domain impersonates a desktop crypto wallet, as indicated by its page title: 'WebAuth Wallet for Windows — Download the Desktop Crypto Wallet.' It was created on June 18, 2026, and resolves to the IP address 91.92.241.250. The domain is registered through Squarespace Domains LLC, which may raise concerns regarding the legitimacy of the site's content.

A notable factor in assessing the threat posed by this domain is its poor trust score of 0/100 from Gridinsoft, indicating a high likelihood of malicious intent. Additionally, the domain appears on four different security blocklists, and 12 out of 95 security vendors on VirusTotal have flagged it for suspicious activities. It is explicitly blocked by several services, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, further corroborating its malicious nature.

The domain has been identified in 14 threat intelligence pulses on AlienVault OTX, suggesting that it has been linked to ongoing malicious activities and is under active scrutiny by the cybersecurity community. The SSL certificate issued by Let's Encrypt does not provide safety assurances, as many phishing sites use valid SSL certificates. Therefore, the presence of SSL should not be interpreted as a sign of legitimacy.

Defenders and security teams should prioritize monitoring for any interactions with this domain within their networks. Blocking access to webauthwallet.org and implementing alerts for any attempts to connect to this IP address could mitigate risks. Additionally, users should be educated on the dangers of downloading software from unverified sources, especially those claiming to be cryptocurrency wallets.