xmrwallet[.]homes

Analysis of the domain xmrwallet.homes shows that it was registered on February 21, 2026 through Dynadot LLC and uses Cloudflare‑provided authoritative name servers algin.ns.cloudflare.com and meiling.ns.cloudflare.com. The domain resolves to the IP address 104.21.30.39, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating that the site is served over plain HTTP. The only visible page title, “Monero Web Wallet – Login to your wallet | xmrwallet.com”, references a cryptocurrency wallet service and aligns with the listed scam type “Crypto Scam”. The threat profile explicitly states brand impersonation of Twitter, although the page title does not reference the Twitter brand, suggesting that the malicious content may have been designed to lure Twitter users to a credential‑stealing or crypto‑draining flow.

The domain is currently offline, and it is listed on a single security blocklist operated by PhishDestroy. VirusTotal scans have returned four positive detections out of ninety‑five AV engines, confirming that at least a subset of security products consider the host malicious. Because the site is hosted behind Cloudflare’s edge network, any further forensic collection would need to be performed on the origin server, which is not directly observable from the public IP. No SSL/TLS fingerprint or certificate transparency data exists to aid reputation scoring.

Defenders should continue to block the domain at perimeter filters and DNS resolvers, add it to internal blocklists, and monitor for any future re‑registration attempts by the same registrar or name‑server configuration. The presence of a Crypto‑related page title combined with a Twitter impersonation claim warrants heightened scrutiny of any outbound traffic to the IP address 104.21.30.39, especially from users who may be authenticating to Twitter services.