x-usdai[.]xyz

PhishDestroy identifies x-usdai.xyz as an active crypto drainer phishing domain first resolved on April 17, 2026. This site is engineered to trick cryptocurrency users into connecting wallets to a malicious smart contract, enabling unauthorized token and NFT transfers to attacker-controlled addresses without further interaction. While no brand is being impersonated in this sample, the domain structure suggests a generic USD-pegged token lure aimed at DeFi participants seeking yield or arbitrage opportunities. This domain was flagged through seed 7b245e after resolving to IP 104.21.93.2 and presenting a Let’s Encrypt SSL certificate. The domain is registered via PDR Ltd. d/b/a PublicDomainRegistry.com and shows 2 out of 95 VirusTotal detections as of capture time, indicating a low detection rate in public scanners. Given its recent creation date and absence from Google Safe Browsing, this domain remains under heavy monitoring for inclusion in blocklists. As of the latest scan, the threat status is active and under investigation. Security vendors have not yet flagged the domain at scale, but behavioral analysis confirms crypto drainer behavior through JavaScript analysis in sandbox environments. Users are advised to block the domain via host file or firewall rule, avoid visiting the site, and scan wallet connections using tools like WalletGuard or PhishFort. Until widespread blocklist coverage is achieved, this domain poses a significant risk to cryptocurrency users engaging with unfamiliar links.