xmrwallet[.]biz

On 21 February 2026 the domain xmrwallet.biz was registered through Web Commerce Communications Limited. The authoritative name resolution points to the single IPv4 address 190.115.31.40, which is announced by AS59692 (IQWeb FZ‑LLC) and geolocated to Belize. The host presents an SSL certificate with an R13 rating, indicating a low trust level. Automated scanning on VirusTotal shows that two of ninety‑five security vendors flagged the domain as malicious, providing an early indication of compromise.

The site is listed on one public security blocklist and has been actively blocked by the PhishDestroy filtering service. The observed page title, “Best Monero Wallet (XMR) – Send & Receive Monero Securely”, suggests that the domain was being used to lure victims into interacting with a purported Monero wallet service. Technology fingerprints extracted from the live response include PHP, jQuery, HTTP Strict Transport Security (HSTS) and the DDoS‑Guard protection layer, a combination frequently observed in malicious crypto‑drainer infrastructure. No additional content analysis is available because the service was taken offline prior to this assessment.

Current evidence confirms the presence of a crypto‑drainer operation associated with xmrwallet.biz, but detailed tactics such as credential harvesting, transaction redirection, or malware delivery have not been observed. Consequently, the precise victim interaction flow remains uncertain. Defenders should continue to enforce domain‑level blocking for xmrwallet.biz, include the associated IP address 190.115.31.40 in network‑level deny lists, and monitor for any future re‑registration or reuse of the same hosting provider. Ongoing threat‑intel feeds should be consulted for updates, and any detection of similar PHP‑based wallet front‑ends should be treated with heightened scrutiny given the observed pattern.