bestwalletxtension[.]com

On 25 July 2026, bestwalletxtension.com was identified as an offline domain that was initially registered on 21 February 2026. The registration was processed by NiceNIC International Group Co., Limited and the domain is delegated to the Cloudflare authoritative nameservers dane.ns.cloudflare.com and phoenix.ns.cloudflare.com. DNS resolution points to the address 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate presented for the site is labeled R11 and the HTTP response includes HTTP Strict Transport Security (HSTS) headers.

An infrastructure scan reveals the presence of Vercel as the underlying hosting platform, which aligns with the observed technology fingerprint. The only content retrieved from the live endpoint was the page title “Best Crypto Wallet: Anonymous Bitcoin Wallet | No ID or KYC”, indicating a crypto‑wallet impersonation campaign that claims to operate without identification or KYC and explicitly references Bitcoin. VirusTotal recorded a single positive detection out of 93 scanned vendors, and the domain appears on one external security blocklist. PhishDestroy has already taken the domain offline and listed it as blocked.

The risk level is classified as elevated and the threat type is brand impersonation targeting the Bitcoin brand. No further page content, login forms, or malicious payloads have been disclosed, leaving the precise method of credential or asset theft uncertain. Security teams should add the domain name and its IP address to inbound and outbound filtering policies, monitor the NiceNIC registrar and Cloudflare name‑service records for any re‑registration or changes, and ensure that any TLS connections to the host are terminated or inspected. Continued surveillance of the AS16509 infrastructure for related activity is advised.