app-infinifi[.]xyz

This domain, app-infinifi.xyz, is identified as a crypto wallet drainer phishing site designed to compromise digital asset wallets by tricking users into authorizing malicious transactions. While no explicit brand impersonation is confirmed, the infrastructure aligns with known wallet-draining kits observed in recent campaigns targeting decentralized finance (DeFi) and cryptocurrency users. The site likely employed social engineering tactics, such as fake airdrop claims or wallet verification prompts, to induce victims into connecting their wallets to the malicious interface. Analysis indicates the domain was registered on March 13, 2026, through Dynadot LLC, a registrar frequently utilized in phishing operations due to its accessibility and bulk registration features. It resolved to the IP address 188.114.97.3, a Cloudflare-hosted endpoint commonly leveraged to obfuscate origin servers and evade takedowns. At the time of assessment, the domain was flagged by 2 out of 95 security vendors on VirusTotal, while appearing on five independent blocklists, including those maintained by cryptocurrency security entities. Technologies detected include Cloudflare’s content delivery network and HTTP/3, with a Let’s Encrypt SSL certificate providing transport layer encryption to lend an appearance of legitimacy. The domain is currently offline, returning a 504 Gateway Time-out error, suggesting either a voluntary takedown by the threat actor or intervention by hosting providers or registrars. Despite its inactive status, residual risk persists due to the potential for rapid redeployment under a new domain or IP address. Users who interacted with the site prior to its takedown are advised to revoke any suspicious wallet authorizations, transfer assets to a new wallet, and monitor transaction histories for unauthorized activity. Organizations are recommended to maintain updated blocklists and implement real-time detection mechanisms to mitigate similar threats.