getalbydesktop[.]app

The domain getalbydesktop.app was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Amazon‑owned address 216.150.1.1 (AS16509, United States). Its authoritative nameservers, albert.ns.cloudflare.com and roxy.ns.cloudflare.com, are hosted by Cloudflare. No TLS certificate is presented, indicating the site operated without HTTPS. The page title returned by the live host was “GetAlby Desktop — Bitcoin Lightning Wallet”, and the intelligence tags classify the activity as a crypto‑scam that impersonates the Bitcoin brand.

VirusTotal recorded three positive detections out of ninety‑three scanners, and the domain appears on a single security blocklist, where it was flagged by PhishDestroy. The current HTTP status is offline, confirming that the malicious host has been taken down. Analysis of the available artifacts shows a typical brand‑impersonation infrastructure: a newly created domain, Cloudflare DNS, and hosting on Amazon AWS, all of which are common choices for short‑lived credential‑harvesting sites. The limited detection footprint (three AV flags) suggests that the payload or landing page was either simple or not widely distributed before takedown.

Because the site is already offline, immediate threat to end users is low, but the underlying infrastructure—particularly the registrar NiceNIC and the IP range 216.150.0.0/16—may be reused for future campaigns. Defenders should add getalbydesktop.app and its resolving IP 216.150.1.1 to block lists in perimeter firewalls and DNS filters, monitor for newly registered domains that share the same registrar or similar naming patterns, and enforce TLS inspection to detect any future attempts to serve content without a certificate. Continuous ingestion of the blocklist that flagged the domain, as well as periodic VirusTotal re‑scans, will help identify re‑emergence of the campaign or related indicators of compromise.