app[.]guiwallet[.]pro

PhishDestroy research identifies the domain app.guiwallet.pro as hosting a live crypto drainer payload, currently under active threat assessment. No brand impersonation or credential theft mechanism has been confirmed, but the site’s behavior aligns with malicious wallet-draining campaigns targeting cryptocurrency users.

Current threat intelligence shows app.guiwallet.pro resolving to IP 172.245.234.113 and protected by a Let’s Encrypt SSL certificate. VirusTotal scanning has returned zero vendor detections out of 95 tested engines as of the latest scan, indicating a yet-unflagged threat. Registrar details, creation date, blocklist count, and trust scores remain unverified in public sources, suggesting a recently launched or carefully obfuscated operation. The absence of detections highlights the challenge of early-stage detection for such drainers.

Given the active status and unverified reputation, PhishDestroy strongly advises users to avoid visiting or interacting with app.guiwallet.pro. Cryptocurrency holders should disable browser extensions on such sites, clear cached wallet connections, and report any suspicious transactions to their wallet provider. Monitor browser extensions and wallet approvals regularly—seed d11f38