app-getrxusd[.]xyz

The domain app-getrxusd.xyz has been assessed as a high-risk crypto drainer site. This type of threat typically involves malicious actors attempting to steal cryptocurrency by tricking users into revealing private keys, seed phrases, or other sensitive information.

Analysis indicates that the domain is currently active and has been flagged by 5 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion among the cybersecurity community. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 172.67.206.27, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). The domain was created on June 10, 2026, and has appeared on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. These indicators, combined with the low trust score from VirusTotal and the presence on multiple blocklists, strongly suggest that the domain is being used for malicious activities.

To mitigate the risks associated with this crypto drainer site, users are advised to avoid interacting with the domain under any circumstances. Security teams should consider adding this domain to their firewall and DNS blocklists to prevent access. Additionally, users should be educated on the signs of phishing attacks, such as suspicious URLs, unexpected prompts for sensitive information, and the importance of verifying the legitimacy of websites before entering any cryptocurrency-related data.