registration-3jane[.]xyz

This domain, registration-3jane.xyz, is currently flagged as an active crypto drainer phishing site designed to compromise digital asset wallets and siphon cryptocurrency. Analysis indicates the domain remains operational, posing a high risk to users who engage with its content or input sensitive credentials. No specific brand impersonation has been confirmed, but the infrastructure aligns with known wallet-draining campaigns targeting decentralized finance platforms. Infrastructure analysis reveals the domain was registered on June 25, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.31.196, which is part of a cloud hosting provider’s network often exploited for phishing operations. The domain appears on two security blocklists, and four of ninety-five VirusTotal security vendors have flagged it as malicious. The SSL certificate is issued by Google Trust Services, a common practice among threat actors to lend legitimacy to phishing sites. The creation date suggests recent deployment, a tactic used to evade detection during early campaign phases. Current status confirms the domain remains active, with no takedown or mitigation efforts observed as of this analysis. Users are strongly advised to avoid interaction with registration-3jane.xyz and any associated links. Network administrators should block the domain and its resolving IP at the perimeter level. Wallet holders should verify transaction requests independently and enable hardware-based or multi-signature authentication for additional security. Monitoring for further indicators of compromise, such as unexpected wallet transactions or unauthorized access attempts, is recommended.