gotbeamedbyanindian[.]xyz

This domain, gotbeamedbyanindian.xyz, is currently flagged as an active crypto drainer phishing site designed to siphon cryptocurrency assets from victims. Analysis indicates the infrastructure is operational, with no evidence of brand impersonation but a clear focus on financial theft through malicious wallet-draining scripts. The domain remains accessible and poses a high risk to users engaging with cryptocurrency transactions or wallet interactions. Infrastructure analysis reveals the domain was registered on June 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 80.94.92.138, which has been linked to other phishing campaigns in recent threat intelligence reports. At the time of analysis, only 2 of 95 security vendors on VirusTotal have flagged the domain, suggesting low initial detection rates and potential evasion of automated defenses. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to malicious sites. The page title, Default Web Site Page, further indicates minimal effort to disguise the site’s true purpose, likely relying on social engineering via direct links rather than search engine visibility. The current status of gotbeamedbyanindian.xyz remains active, with no indications of takedown or disruption. Users are strongly advised to block the domain and its associated IP address (80.94.92.138) at the network level. Cryptocurrency wallet users should verify all transaction prompts independently and avoid interacting with unsolicited links or pop-ups. Organizations are recommended to update endpoint detection rules to include this domain and monitor for connections to the resolving IP. Given the low detection rate, manual verification of all cryptocurrency-related communications is critical to mitigating financial loss.