treasury-zinc[.]xyz

This domain, treasury-zinc.xyz, is actively distributing a crypto wallet drainer designed to steal digital assets from unsuspecting users. The site mimics legitimate cryptocurrency platforms, tricking visitors into connecting their wallets or entering private keys. Once compromised, funds are irreversibly transferred to attacker-controlled addresses without user consent or notification. Analysis indicates the domain was registered on June 23, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently exploited for malicious infrastructure. VirusTotal detection shows 2 out of 95 security vendors currently flag the domain as malicious. The site resolves to IP address 104.21.44.200, hosted on Cloudflare’s network (AS13335), and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. If you visited treasury-zinc.xyz or interacted with its content, immediately disconnect any connected wallets and revoke permissions via your wallet’s settings. Transfer remaining assets to a new, secure wallet address. Monitor all linked accounts for unauthorized transactions and enable transaction alerts if available. Do not reuse passwords or recovery phrases associated with the compromised wallet. Report the domain to your wallet provider and relevant security teams for further mitigation.