xmrwalllet[.]com

Analysis as of July 25 2026 indicates that www.xmrwalllet.com was registered on February 21 2026 through MAT BAO CORPORATION and is presently taken offline. The site presented the title “Best Monero Wallet (XMR) – Send & Receive Monero Securely,” indicating a targeted crypto‑wallet phishing campaign. Infrastructure observation shows resolution to IP 85.192.48.109, hosted in Finland under autonomous system AS215730 operated by H2NEXUS LTD. The domain employed a Let’s Encrypt R13 certificate, confirming TLS usage at the time of capture. DNS configuration listed ns1.guatda.com and ns2.guatda.com as authoritative servers.

Content‑delivery stack identified PHP on Ubuntu behind Nginx with client‑side jQuery, a common combination for phishing kits. The observed kit matches the “Seed Phrase Phishing” template, which typically harvests mnemonic phrases used to restore cryptocurrency wallets. Reputation services flagged the domain on a single security blocklist and three of ninety‑three VirusTotal scanners marked it as malicious. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification.

PhishDestroy has already blocked the domain, and its current HTTP status is offline, limiting active exploitation but leaving the infrastructure reusable for future campaigns. Defenders should add 85.192.48.109 to network deny lists, enforce DNS sinkholing for www.xmrwalllet.com and its authoritative name servers, and update intrusion‑detection signatures to capture the Seed Phrase Phishing pattern. Continuous monitoring of the AS215730 prefix for new domains with similar name‑server sets is recommended, as the hosting provider may be leveraged for additional crypto‑related scams. Although the site is offline, its observable artifacts provide sufficient indicators of compromise to pre‑empt re‑use.