xeltrionwallet[.]com

Analysis indicates that www.xeltrionwallet.com is actively serving a counterfeit web page titled “Xeltrion wallet”. The site returns HTTP 200 and presents a login interface that mimics a cryptocurrency wallet, a pattern commonly used to harvest private keys for draining crypto assets. The page is cataloged as a generic phishing site and the overall risk rating is high. The domain was registered on 11 February 2026 through Realtime Register B.V. and is hosted on IP 185.141.24.71, which belongs to AS60117 (Host Sailor Ltd) located in the Netherlands. Authoritative name servers are alpha.hostlife.net and beta.hostlife.net. An MX record points to mail.xeltrionwallet.com with priority 10, suggesting a functional mail channel that could be used for credential exfiltration. The site uses a Let’s Encrypt certificate (YR1), confirming the presence of a valid TLS chain despite its malicious purpose. Infrastructure assessment shows the domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. VirusTotal reports a single vendor flagging the domain out of 95 checks, indicating limited detection coverage but not mitigating the observed malicious behavior. The combination of a fresh registration date, low trust score, and active blocklist presence demonstrates a deliberate, short‑lived campaign. Defenders should immediately block www.xeltrionwallet.com and its resolved IP address at network perimeters. Continuous monitoring of the associated IP range and related host‑life name servers is advised to catch potential repointing. Email filters ought to reject messages originating from mail.xeltrionwallet.com. End‑users must be warned that any unsolicited request for cryptocurrency credentials matching the “Xeltrion wallet” brand is likely a crypto‑drainer attempt, and legitimate interactions should only occur through verified channels.