xstocks-defi[.]vip

This domain is identified as a crypto drainer, a type of malicious infrastructure designed to automatically siphon cryptocurrency from connected wallets. Victims are typically lured through deceptive investment schemes or fake decentralized finance (DeFi) platforms, where interacting with the site triggers unauthorized transactions that transfer assets to attacker-controlled addresses. The domain's infrastructure and content are engineered to mimic legitimate financial services, increasing the likelihood of user compromise. Analysis indicates the domain was registered on April 09, 2026, through Dynadot Inc, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.197.52 and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. Security vendors have flagged this domain on VirusTotal, with 7 out of 95 engines detecting malicious activity. It appears on four security blocklists and is actively blocked by multiple wallet protection systems, including MetaMask and SEAL. The page title, 'Products - xStocks,' suggests an attempt to impersonate a financial or investment platform. Users who visited xstocks-defi.vip or connected a wallet to this domain should assume their credentials or funds are compromised. Immediately disconnect the wallet from any associated dApps and revoke all smart contract approvals using a trusted blockchain explorer. Transfer remaining assets to a new, secure wallet and monitor all connected accounts for unauthorized transactions. If funds were lost, report the incident to relevant blockchain analytics services and local cybercrime authorities. Avoid interacting with any links or communications originating from this domain, as they may lead to further exploitation.