myetherwalletdesktop[.]app

Analysis of the domain myetherwalletdesktop.app shows that it was operated as a brand‑impersonation site targeting cryptocurrency users. The domain was registered through Vercel Inc. and was served from the IP address 216.150.1.1, which is owned by Amazon.com, Inc. (AS16509) and geolocated to the United States. DNS resolution uses Cloudflare nameservers frank.ns.cloudflare.com and nia.ns.cloudflare.com, yet the site offered no TLS certificate, meaning connections were unencrypted. The page title returned by the server – “Download MyEtherWallet Desktop — Official MEW Wallet” – aligns with the declared scam type of Wallet/Seed Phishing and indicates an attempt to lure victims into providing private keys or seed phrases. VirusTotal recorded 13 positive detections out of 95 commercial scanning engines, and the domain appears on a single external blocklist.

PhishDestroy also listed the site as blocked. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The site has been taken offline, and its current HTTP status is unavailable. No additional evidence such as screenshots, malware payloads, or observed victim reports is present in the intelligence set, leaving the exact content of the landing page unverified beyond the title.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual email campaigns that reference the same URL, and consider adding the IP address 216.150.1.1 to threat‑intel feeds. Because the infrastructure resides on a major cloud provider, future campaigns may reuse the same hosting environment, so periodic re‑scanning of the IP and associated sub‑domains is advisable. The lack of TLS and the low trust score indicate a low level of operational sophistication, but the brand‑impersonation tactic remains high‑risk for users of MyEtherWallet.