xxccmgxmgx[.]top

This domain, xxccmgxmgx.top, is identified as a crypto wallet drainer specifically designed to impersonate MGX, a digital asset platform. Analysis indicates the site employs deceptive interfaces mimicking legitimate wallet login and transaction pages to trick users into authorizing malicious smart contracts. Once permissions are granted, the drainer automatically siphons cryptocurrency holdings from connected wallets, often leaving victims with irreversible losses. The threat targets users through phishing links distributed via social engineering, malicious advertisements, or compromised communication channels. Infrastructure analysis reveals the domain was registered on February 23, 2026, through Gname.com Pte. Ltd., an offshore registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin and evade takedowns. The domain lacks a valid SSL certificate, further indicating malicious intent. Detection metrics confirm its malicious status, with 12 out of 95 security vendors on VirusTotal flagging it as harmful. Additionally, the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in tracking crypto-related threats. Users who interacted with xxccmgxmgx.top should immediately revoke any wallet permissions granted to unknown or suspicious contracts. Disconnecting the wallet from all decentralized applications (dApps) and transferring remaining assets to a new, secure wallet is strongly recommended. Monitor transaction histories for unauthorized activity and report the incident to relevant security communities or platforms. Given the domain’s current offline status, users should remain vigilant for similar threats, as operators often re-deploy infrastructure under new domains. Proactive measures, such as verifying URLs through official sources and using hardware wallets, can mitigate future risks.