xcoin-trade[.]io

This domain, xcoin-trade.io, is flagged as a confirmed brand impersonation phishing site targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the site masquerades as a legitimate wallet service, as evidenced by the page title 'X Wallet,' likely designed to deceive users into entering sensitive credentials or transferring cryptocurrency assets. No evidence of a specific drainer kit was identified, but the infrastructure aligns with known phishing campaigns impersonating cryptocurrency services to harvest login details or private keys. Infrastructure analysis reveals critical technical indicators: the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.65.205, located in the United States under AS13335 (Cloudflare, Inc.), a common hosting provider for phishing sites due to its proxy services. The domain lacks an SSL certificate, a red flag for user security. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. Google Safe Browsing (GSB) data was not explicitly provided, but the domain's characteristics strongly suggest it would be classified as unsafe. As of the latest assessment, xcoin-trade.io has been taken offline, likely due to enforcement actions by security providers or hosting services. However, the risk of reemergence remains elevated, as threat actors often reuse infrastructure or register similar domains. Users are advised to verify domain authenticity before interacting with any cryptocurrency service, particularly those impersonating major exchanges. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-up campaigns. Immediate reporting to relevant security teams and domain registrars is recommended to prevent further abuse.