Wraith
Domains Hosting SSL DNS Features Pricing
Request Access Operator Login
3 edge nodes · All operational · Invite-only

Register.
Host. Control.

Privacy-first domain registration, managed hosting, SSL and DNS for security professionals. Crypto billing. No KYC. No logs. Invite-only access.

Access Login
.io .com .net .co .org .dev .cloud .app
Domain Registration
Managed Hosting
Auto SSL
DNS Management
Crypto Billing
99.9%
Uptime SLA
3
Global edge nodes
<5ms
DNS propagation
100+
Crypto accepted
Services

Everything you need.
One platform.

From domain registration to managed hosting, SSL and DNS — every layer is handled by Wraith. Privacy-first, operator-controlled.

Domain Registration
Privacy-first registration via Njalla — your identity never touches the registrar. Register directly from the Telegram bot in seconds. Auto DNS configuration included.
From $70 per domain
Managed Hosting
Dedicated isolated hosting account per engagement. Separate credentials, separate web root — complete isolation. Or bring your own upstream for external mode.
From $50 per engagement
SSL Certificates
Automatic TLS via DNS-01 challenge. Certificates issued, renewed and deployed to all 3 edge nodes automatically — zero manual steps, zero downtime on renewal.
Included with every domain
DNS Management
Full DNS record management via Cloudflare, controlled directly from your Telegram bot. A, CNAME, TXT and MX records via short callback menus. Sub-5ms propagation.
Included with every domain
Platform features

Built for adversarial
infrastructure

Every layer engineered around operational security — from traffic routing and AV transparency to live alerting and crypto billing.

Multi-protocol redirector
Route C2 traffic over HTTPS and DNS. Each engagement gets an isolated RedGuard-powered edge slot. Config changes propagate to all nodes in under 5 seconds.
Geo-aware traffic filtering
Allowlist by country, block by ASN, deny by IP range. Known scanner and blue-team ASNs are silently dropped before any traffic reaches your upstream.
AV-transparent domains
Google Safe Browsing and VirusTotal checks at registration. Flagged domains hit the silent blackhole — never reach your C2, never surface as indicators.
Canary tripwires
Embed random canary paths in documents, emails or pages. Any visit fires an instant Telegram alert with full IP, user-agent and path information.
Single-use lure links
HMAC-signed tokens with 7-day TTL. Burns on first successful proof-of-work. Export as QR codes to bypass email URL scanners that visit but don't decode images.
Telegram-native control
Every function — hosting, domains, DNS, lures, billing, alerts — accessible directly from Telegram. Full ops control from your phone, no browser required.
External redirector support
Point Wraith at any HTTPS endpoint. The edge layer handles all filtering and inspection — your infrastructure stays invisible behind the redirector.
Anonymous crypto billing
Fund with BTC, ETH, USDT and 100+ cryptocurrencies. No KYC, no card, no identity. Balance never expires — pay once, spend on engagements and domains as needed.
Operator dashboard
Full web-based console for engagement management, live traffic inspection, audit logs and team invite management. Invite-only, zero public access.
Infrastructure

3-node global
edge network

Three dedicated edge nodes across Europe, each running RedGuard for traffic inspection. Fully isolated — a compromised edge never exposes other engagements or operators.

Edge-01 · EU West
80.96.108.86
Online
Edge-02 · EU Central
194.110.247.193
Online
Edge-03 · EU North
80.96.108.252
Online
Data centre
All nodes operational
Workflow

Operational
in minutes

01
Receive your invite
Access is invite-only. Your operator issues a single-use code via the bot. No public registration, no waitlist.
02
Fund your wallet
Top up with crypto via /topup. BTC, ETH, USDT and 100+ currencies. Balance never expires.
03
Register a domain
Run /domain to register via Njalla. Privacy-protected — your identity never touches the registrar.
04
Spin up hosting
Run /host to provision managed hosting or point at your own upstream. TLS cert issued automatically.
05
Deploy & monitor
Generate lure links, set canary tripwires, manage DNS — all from Telegram. Live alerts on every interaction.
wraith-bot · ops
you /domain
🌐 Register a new domain
you ops.redteam.io
✔ Available — $70
✔ Registered via Njalla
✔ DNS → Cloudflare
✔ TLS cert issued

you /host
▸ Wraith-hosted ▸ External
✔ Hosting account created
✔ Edge-02 configured

you /lure canary
✔ Canary set · /r/a3f9c2

⚠ CANARY HIT · 185.220.x.x
Tor exit · Auto-blocked
Wallet packages

Pay per operation.
No subscriptions.

Top up your wallet once, spend as you go. Crypto only — no card, no KYC, no paper trail. Balance never expires.

Starter
$149
one-time wallet credit
~2 managed hosting slots
~1 domain registration
Full Telegram bot access
SSL + DNS included
Balance never expires
Top up via bot
Pro — Most popular
$349
one-time wallet credit
~4 managed hosting slots
~4 domain registrations
Multiple parallel engagements
Canary alerts + lure gen.
Balance never expires
Top up via bot
Operator
$799
one-time wallet credit
~10 managed hosting slots
~10 domain registrations
Invite issuance capability
Priority edge allocation
Full audit trail export
Top up via bot
Wraith-hosted engagement
$150 flat
External redirector slot
$50 flat
Domain registration
$70 flat
Access

Invite-only.
No public signup.

Wraith is a closed platform. There is no public registration, no waitlist, and no self-serve onboarding. Access is granted by existing operators via a single-use invite code issued directly through the bot.

If you are part of an authorised engagement and need access, your engagement lead will issue an invite. All usage is scoped to authorised engagements only.

Operator Login Dashboard
Invite-only platform

Already have
an invite?

Start the Wraith Telegram bot, send your invite code and your account activates immediately. Top up your wallet to start provisioning.

Telegram bot
Contact your operator for the bot link
Operator console
panel.wraithsecurity.org