mint-portal[.]xyz

This domain, mint-portal.xyz, operates as a crypto drainer phishing site designed to deplete cryptocurrency wallets by tricking users into connecting their wallets to malicious smart contracts. Once connected, the site executes unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat primarily targets individuals interacting with decentralized finance (DeFi) platforms or wallet management interfaces, leveraging social engineering tactics to appear legitimate. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.152.248, which is part of Cloudflare’s network, a common obfuscation technique to mask the true hosting provider. Detection data from VirusTotal shows that 5 out of 95 security vendors flag the domain as malicious, while it appears on one additional security blocklist. The site employs HTTP/3 and HSTS, likely to enhance perceived legitimacy, and uses Cloudflare Browser Insights for performance monitoring, though this is atypical for benign services. Users who visited mint-portal.xyz or interacted with its content should immediately disconnect any connected wallets from the site and revoke permissions for all suspicious smart contracts. It is recommended to audit wallet transaction histories for unauthorized transfers and transfer remaining funds to a new, secure wallet. Enabling multi-factor authentication on all cryptocurrency-related accounts and monitoring for further phishing attempts via email or social media is advised. If financial loss occurred, report the incident to relevant authorities and provide all transaction hashes and domain interaction details for further investigation.