clawmintwlfi[.]xyz

Analysis of the domain clawmintwlfi.xyz indicates it is an active crypto drainer phishing site targeting users of the Binance Smart Chain (BSC) ecosystem. The domain was registered on March 6, 2026, through NameCheap, Inc., and currently resolves to the IP address 216.198.79.1. The site presents itself as an 'AI Agent NFT Platform on BSC,' as evidenced by its page title, suggesting an attempt to lure victims into interacting with malicious smart contracts designed to drain cryptocurrency assets. Infrastructure analysis reveals the domain is flagged by four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Additionally, it appears in 23 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. While six of 95 security vendors on VirusTotal have detected the domain as malicious, the remaining vendors have not yet issued detections, indicating variability in coverage across detection systems. The domain maintains an SSL certificate issued by Let's Encrypt, a common tactic to lend an appearance of legitimacy to phishing sites. Defenders should treat this domain as high-risk due to its confirmed association with crypto draining activity. The domain remains active as of July 12, 2026, and no evidence suggests takedown efforts have been successful. Network-level blocking of the resolving IP (216.198.79.1) and domain-level blocking are recommended to mitigate exposure. The exact content and mechanics of the phishing kit are not yet analyzed, but the combination of blocklist presence, threat intelligence reporting, and the domain's stated purpose align with known crypto drainer campaigns. Further investigation into associated wallet addresses and smart contracts is advised to disrupt the broader infrastructure.