x125d[.]xyz

This domain, x125d.xyz, operates as a crypto wallet drainer designed to steal digital assets by tricking users into entering private keys or seed phrases. The site mimics legitimate wallet interfaces, luring victims into authorizing malicious transactions that irreversibly transfer funds to attacker-controlled addresses. Analysis indicates the threat is highly effective due to its polished frontend and use of modern web technologies to evade detection. Infrastructure analysis reveals the domain was registered on May 5, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 103.27.177.164 and employs multiple obfuscation techniques, including Cloudflare proxying, HSTS enforcement, and HTTP/3 support. Detection engines on VirusTotal flag the domain as malicious, with 9 out of 95 security vendors confirming its fraudulent nature. The use of Let's Encrypt SSL certificates further complicates manual verification, as the site appears secure to unsuspecting users. If you visited x125d.xyz or interacted with its content, immediately disconnect the affected device from the internet to prevent further data exfiltration. Revoke any wallet permissions granted to the site using a trusted blockchain explorer. Transfer remaining assets to a new wallet with a fresh seed phrase, as the original may be compromised. Monitor connected accounts for unauthorized transactions and report the incident to relevant platform support teams. Users should also scan their devices for malware, as crypto drainers often deploy additional payloads to maintain persistence.