xmrwallet[.]app

This domain, xmrwallet.app, was registered on February 21, 2026 through Tucows Domains Inc. and is presently active. It presents the page title "XMR Wallet Online | Secure Monero Wallet," indicating an attempt to masquerade as a legitimate Monero wallet service. The threat is classified as a crypto drainer and assigned a high risk rating. The site responds with an HTTP 307 temporary redirect, suggesting a redirection stage before delivering payload. SSL analysis shows a certificate labeled R12, issued for the domain, and the site enforces HTTP Strict Transport Security (HSTS). Infrastructure fingerprints reveal deployment on Vercel, and DNS resolution points to the Amazon‑owned address 216.198.79.65, belonging to AS16509. The three nameservers – 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo – are hosted by the njalla service. VirusTotal has recorded a single detection out of 95 scanned security vendors, indicating limited but present antivirus awareness. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation. No additional intelligence on the page content has been released, so the exact mechanisms used to drain cryptocurrency remain unverified. Defenders should block DNS resolution to 216.198.79.65 and add the domain to web filtering rules. Monitoring for HTTP 307 responses from this host can aid early detection. Given the use of Vercel and the njalla nameserver set, threat‑hunting queries targeting similar infrastructure may uncover related campaigns. Continuous re‑scanning with VirusTotal and updating blocklist signatures are recommended to capture any emerging detections.