typhondesktop[.]io

Analysis of typhondesktop.io shows a newly registered domain (creation date October 09, 2025) that was taken offline before the report date of July 23, 2026. The domain resolves to the IPv4 address 216.198.79.65, which is hosted in the United States under ASN16509 (Amazon.com, Inc.). No TLS certificate is presented, indicating that the site operated without HTTPS. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting use of Vercel's DNS service for fast deployment. The registrar listed is HOSTINGER operations, UAB.

The page title captured from the site reads "Typhon Wallet", and the threat is classified as a Wallet/Seed Phishing campaign that impersonates the Ledger brand. VirusTotal scans returned 16 detections out of 95 security vendors, demonstrating a moderate level of consensus among scanners that the domain is malicious. The domain appears on a single public blocklist, PhishDestroy, which has already flagged it for distribution to protective services. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The absence of SSL, the low trust score, and the presence on a phishing blocklist collectively confirm the domain's intent to harvest cryptocurrency wallet credentials.

Defenders should ensure that the IP address 216.198.79.65 is blocked at perimeter firewalls and that any outbound connections to this address are logged. DNS queries for typhondesktop.io should be intercepted or redirected to a sinkhole to prevent future resolution. Monitoring should be extended to other domains registered through HOSTINGER operations, UAB and to any new domains that resolve to the same Amazon AS16509 range, as threat actors often reuse infrastructure. Because the site is currently offline, real‑time content analysis is not possible; however, the existing indicators—page title, brand impersonation, detection count, and blocklist entry—provide sufficient evidence for a proactive defensive posture.