h5[.]goldcicada[.]xin

This domain is flagged as an active crypto drainer phishing operation targeting cryptocurrency wallet users. Analysis indicates the site employs deceptive customer service interfaces to trick victims into authorizing malicious transactions, leading to unauthorized fund drainage from connected wallets. The risk level is classified as elevated due to confirmed malicious activity and infrastructure designed to evade detection. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3, utilizes Cloudflare for hosting and HTTP/3 for network communication, and employs Ant Design and Vue.js frameworks. It was registered on September 08, 2025, through Dominet (HK) Limited, with an SSL certificate issued by Google Trust Services. The domain appears on three security blocklists and is flagged by 3 out of 95 security vendors on VirusTotal. Additional detections include blocking by MetaMask, PhishDestroy, and SEAL, while Gridinsoft assigns a trust score of 0/100. The page title, 'Customer Service,' is consistent with social engineering tactics used in crypto drainer schemes. Mitigation requires immediate action from both users and security teams. Users who interacted with this domain should revoke all connected wallet authorizations, transfer remaining assets to a new wallet, and scan devices for malware. Security teams should add the domain (h5.goldcicada.xin), IP (188.114.97.3), and registrar (Dominet (HK) Limited) to blocklists. Monitoring for similar domains registered through the same registrar or resolving to the same IP is recommended. Given the use of Cloudflare, additional scrutiny of domains with Google Trust Services SSL certificates is advised to identify related threats.