What Gridinsoft observed on leapwallet.co
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261029012419-679f5874
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current redirected flow requests wallet recovery secrets and contains code that prepares them for server submission. The observed risk supports the existing warning; completed theft or a malware file was not demonstrated.
Analyst findings
Review 3 documented observations View evidence
The apex returned a 301 redirect to leapwallet.to. That destination uses Leap Wallet branding and Connect Wallet links. Its /connect-wallet page offers recovery-phrase and private-key import; opening the phrase option displays 12 word fields and a 24-word option. This is an interactive secret-entry flow, not only informational content.
- Public artifact URL https://leapwallet.co/
- Public artifact URL https://leapwallet.to/
- Public artifact URL https://leapwallet.to/connect-wallet
The inspected public JavaScript passes the phrase and private-key input values to a shared function on Continue. That function obtains /public-key, encrypts the supplied secret and constructs a POST to /collect-analytics with the encrypted value and browser metadata. This is static evidence of server-directed secret collection; no real secret was entered and no collection POST was sent in this review.
- Public artifact URL https://leapwallet.to/_next/static/chunks/2j8p2phaig3a_.js
Existing October 28-29 URLscan metadata independently records leapwallet.co ending at leapwallet.to. OTX associates three pulses with the apex but returned no linked malware samples. These external records do not establish completed theft, the original classification cause or permission to represent Leap Wallet.
- Public artifact URL https://urlscan.io/result/01a18510-5dd7-70d9-874c-accffd30ba0f/
- Public artifact URL https://otx.alienvault.com/indicator/domain/leapwallet.co
Scope and limitations
- No wallet was connected, no phrase or private key was entered, and no form, consent or transaction was submitted. Server receipt, storage, operator identity, brand authorization and any victim loss were not independently established.
- The www host failed TLS hostname validation and was not bypassed. The finding concerns the apex redirect and inspected destination, not every subdomain or an audit of the unrelated official service. Historical content and continuous ownership remain unestablished.
Help protect others by sharing this page on social media! The more people who know about leapwallet.co, the fewer chances they have to deceive someone else. Help others evaluate leapwallet.co by sharing this page on social media!