portal-getrxusd[.]xyz

This domain, portal-getrxusd.xyz, is identified as a high-risk crypto drainer phishing site designed to steal digital assets from unsuspecting users. Analysis indicates the site mimics legitimate cryptocurrency wallet or exchange interfaces, tricking visitors into entering private keys or seed phrases. Once obtained, these credentials are used to drain funds from connected wallets, resulting in irreversible financial loss. The site employs social engineering tactics, often promoted through malicious ads or compromised social media accounts, to lure victims into interacting with it. Infrastructure analysis reveals the domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 104.21.66.145, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate the true origin of malicious sites. The domain is flagged by 5 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. Additionally, the SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy that may deceive less technical users. If a user has visited portal-getrxusd.xyz or entered any sensitive information, immediate action is required. First, disconnect the device from the internet to prevent further data exfiltration. Next, revoke any wallet connections or approvals granted to the site using a trusted wallet interface. Transfer remaining assets to a new, secure wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams or platforms. Users should also scan their devices for malware using updated security tools, as phishing sites often distribute additional payloads. Finally, exercise caution with future interactions, verifying domain authenticity before entering credentials or connecting wallets.