chainxrpsaving[.]com

This domain, chainxrpsaving.com, operates as a fraudulent USDT savings platform designed to drain cryptocurrency wallets. Analysis of the page title, "USDT Savings," and associated infrastructure indicates a targeted phishing scheme aimed at users of Tether (USDT) and related blockchain assets. Victims are likely lured through social engineering tactics, such as fake investment opportunities or yield farming scams, with the intent to harvest wallet credentials, private keys, or seed phrases. Once entered, these credentials are transmitted to attacker-controlled servers, enabling unauthorized transfers of funds from the victim's wallet to addresses under the threat actor's control. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 118.107.28.253, hosted in Hong Kong under AS152194 (CTG Server Limited), an autonomous system with a history of hosting phishing and malware distribution sites. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, including detections for phishing and malicious activity. Notably, the domain lacks an SSL certificate, increasing the risk of credential interception during transmission. Google Safe Browsing has also classified this domain as phishing, further corroborating its malicious intent. Users who visited chainxrpsaving.com or interacted with its content should take immediate action to mitigate potential compromise. First, disconnect any wallets linked to the site and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Second, transfer remaining funds to a new, secure wallet with a fresh seed phrase. Third, monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials or private keys were entered, assume full wallet compromise and cease using the exposed wallet. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actor's infrastructure.