monerogui[.]at

Analysis indicates that the domain monerogui.at is an active crypto drainer phishing site, currently resolving to the IP address 94.23.162.163, hosted on infrastructure associated with OVH GmbH in Germany. The domain was registered through Key-Systems GmbH, a registrar commonly utilized for both legitimate and malicious domains. Infrastructure analysis reveals the use of nameservers ns1.emailverification.info and ns2.emailverification.info, which have been previously linked to phishing campaigns targeting cryptocurrency users. The page title, 'Contact Verification Suspension Page,' suggests an attempt to deceive users into interacting with a fraudulent verification process, likely designed to drain cryptocurrency wallets. As of July 12, 2026, the domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100, indicating a high-risk classification. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently validate the legitimacy of the site but ensures encrypted connections. The domain remains active, returning an HTTP 200 status, and is detected by 5 of 91 security vendors on VirusTotal, further corroborating its malicious nature. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for connections to the associated IP address 94.23.162.163. Given the domain's classification as a crypto drainer, organizations handling cryptocurrency transactions should alert users to avoid interaction with this site. The exact content and mechanics of the phishing page are not yet fully analyzed, but the available evidence confirms its role in a high-risk phishing campaign.