algowalletdesktop[.]icu

PhishDestroy identifies algowalletdesktop.icu as a live crypto drainer masquerading as the legitimate AlgoWallet Desktop application. The domain employs a near-identical visual clone to harvest private keys and seed phrases under the guise of a desktop wallet installer. Security vendors have not yet flagged the page, indicating this threat is in its early, escalating phase with potential for rapid expansion across unsuspecting user communities. algowalletdesktop.icu was registered on April 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to a dedicated IP at 216.198.79.65. A Let's Encrypt SSL certificate lends superficial legitimacy, while VirusTotal currently shows 0 detections out of 95 engines, and Google Safe Browsing has not yet blacklisted the domain. The seed phrase for this campaign is 63cd56, enabling tracking of related infrastructure. This domain remains active with no takedown actions reported. Users are advised to avoid downloads from algowalletdesktop.icu and verify any AlgoWallet software through official channels only. The current risk is classified as under_investigation, but the absence of detections suggests a window of opportunity for threat actors to escalate operations before widespread blocking occurs.