zoomchains[.]xyz

This domain hosts a confirmed crypto wallet drainer designed to steal digital assets from unsuspecting users. The site mimics legitimate wallet interfaces, tricking visitors into connecting their wallets or entering seed phrases, which are then exfiltrated to attacker-controlled addresses. Infrastructure analysis reveals the domain is optimized for rapid fund siphoning, with minimal user interaction required to initiate unauthorized transactions. Analysis indicates the domain was registered on June 15, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com. It is flagged by 4 out of 95 security vendors on VirusTotal, including detection for generic phishing and wallet-specific threats. The domain resolves to IP address 13.248.169.48 and uses a GoDaddy-issued SSL certificate, a common tactic to appear legitimate. It appears on three security blocklists and is actively blocked by multiple wallet security providers. If you visited zoomchains.xyz or interacted with the site, immediately disconnect any connected wallets from the internet. Revoke all active sessions and permissions granted to unknown dApps or addresses. Transfer remaining assets to a new, secure wallet using a clean device. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain security teams for further investigation. Do not reuse compromised seed phrases or private keys.