monerogui[.]com

PhishDestroy identifies monerogui.com as an active Monero-draining phishing site under investigation as of seed 2512f8. The domain shows no affiliation with legitimate Monero projects and employs a generic but deceptive naming convention to lure victims. While no specific drainer kit was detected during initial analysis, the site’s structure and recent creation suggest it is likely utilizing a kit or custom script to facilitate unauthorized Monero transactions.

This domain was flagged with a VirusTotal detection score of 0 out of 95 engines, indicating it remains undetected by most antivirus solutions. It was registered through TUCOWS.COM, CO., resolving to IP address 69.10.36.99 and secured with a Let’s Encrypt SSL certificate. The domain was created on October 07, 2025, and has not yet been listed on Google Safe Browsing (GSB) or other major blocklists, leaving potential victims exposed.

As of now, monerogui.com remains active and poses a moderate risk to cryptocurrency users. Immediate actions include blocking the domain at the network perimeter, updating firewall rules to include IP 69.10.36.99, and distributing IOCs to threat intelligence platforms. Users are advised to avoid interacting with the site and to verify cryptocurrency-related domains through official channels. The remaining risk is classified as active but under investigation, with further analysis pending additional telemetry.