typhonwallet[.]app

Analysis indicates that typhonwallet.app is actively used in a high‑risk crypto drainer campaign. The site presents the page title “Typhon Wallet – the most secured cardano wallet”, suggesting an attempt to lure Cardano users. The domain was registered on 17 Nov 2025 through Tucows Domains Inc. and received a Gridinsoft trust score of 0 / 100. Technical fingerprinting shows the site is hosted on Vercel with HSTS enabled and serves a Let’s Encrypt R12 certificate. HTTP requests receive a 307 redirect response. DNS resolution points to IP 216.198.79.1, an Amazon.com (AS16509) address located in the United States, and the domain uses three njalla nameservers (1‑you.njalla.no, 2‑can.njalla.in, 3‑get.njalla.fo). VirusTotal reports 12 of 95 scanners flagging the domain, and it is listed on one security blocklist and blocked by PhishDestroy. The intelligence classifies the activity as a crypto scam, specifically a crypto drainer. No additional content analysis is available, so the exact phishing flow and payload remain unconfirmed. Defenders should immediately block the domain and its resolving IP, add the observed nameservers to threat‑intel feeds, enforce TLS inspection to capture any malicious payload, and monitor for related indicators of compromise in network traffic. Continuous re‑scan of the domain is recommended to capture any changes in detection status.