incentiv-testnet[.]xyz

This domain, incentiv-testnet.xyz, is confirmed to operate as a phishing site targeting users of blockchain-based reward platforms. Analysis indicates the site mimics legitimate cryptocurrency incentive programs, presenting itself as 'Incentiv | Simple, Inclusive, and Rewarding Blockchain' to deceive visitors into disclosing wallet credentials, private keys, or installing malicious software. The primary threat involves credential harvesting and unauthorized access to digital assets, with potential secondary risks including malware distribution or further social engineering attacks via collected user data. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on June 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, which, while providing encryption, does not validate the site's legitimacy. VirusTotal detection shows 2 out of 95 security vendors have flagged the domain as malicious, and it appears in one threat intelligence pulse on AlienVault OTX. The creation date discrepancy (2026) suggests domain age manipulation, a common tactic to evade reputation-based filters. Users who have visited incentiv-testnet.xyz or interacted with its content should take immediate action to mitigate risks. First, revoke any wallet permissions or connected applications associated with the site. Conduct a full scan of the device using updated security tools to detect potential malware. Monitor all linked accounts, including cryptocurrency wallets and email, for unauthorized transactions or access attempts. If credentials were entered, assume they are compromised and update them across all platforms where reused. Report the domain to relevant security teams and consider submitting samples to threat intelligence platforms to aid in broader detection efforts. Given the high-risk classification and active status, avoid any further interaction with the domain or related communications.