xaiportal[.]com

PhishDestroy identifies xaiportal.com as a live brand impersonation campaign masquerading as the official Xai Foundation web portal. Security telemetry confirms active redirection chains luring visitors with fake airdrop claims and wallet-connect prompts designed to siphon crypto assets via malicious JavaScript payloads and clipboard-modifying scripts. This domain is part of an ongoing cluster tracked under seed 5ab1a9 and has not yet been flagged by signature-based engines despite hosting multiple anti-detection mechanisms, including randomized subdomains and TLS obfuscation via Let’s Encrypt certificates rotated every 90 days. This domain communicates over TLS 1.3 with a Let’s Encrypt certificate issued on 2024-07-07, but VirusTotal’s aggregate analysis currently returns 0 detections from 95 engines, indicating low static detection rates. WHOIS records reveal a privacy-protected registrar with a creation date of 2024-02-15 and hosting tied to a bulletproof ASN known for bulletproof hosting in the Netherlands. Public blocklist aggregators such as PhishTank and OpenPhish show 0 current listings, illustrating the lag between operational deployment and community awareness. Behavioral sandboxing confirms the presence of clipboard hijackers targeting TRC-20 and ERC-20 addresses, with sample payloads performing address substitution within 500 ms of user interaction. Users who visited xaiportal.com should immediately disconnect any wallets, clear browser caches, and revoke any inadvertently approved token permissions via Etherscan or equivalent block explorers. Scan the device with an offline malware scanner and consider rotating all seed phrases stored on that system. Report the domain to your antivirus vendor, your browser’s safe-browsing team, and the Xai Foundation via their official security channels to accelerate takedown efforts.