xai-official[.]icu

This domain, xai-official.icu, actively serves a cryptocurrency-draining landing page designed to trick wallets into signing malicious permission requests that silently transfer tokens to attacker-controlled addresses. Users who connect their wallet or approve transactions may suffer irreversible asset loss within seconds; blockchain explorers reveal multiple reported thefts totaling thousands of dollars in XAI and other tokens linked to this exact domain. PhishDestroy identifies xai-official.icu as an elevated-risk phishing host flagged by 5 of 95 VirusTotal security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. WHOIS records tied to this seed indicate the domain was activated in mid-2024 and has already accumulated multiple blocklist hits across threat-intelligence feeds, reflecting a growing operational footprint used for quick-hit crypto theft campaigns rather than prolonged credential harvesting. Anyone who visited or interacted with xai-official.icu should immediately revoke any wallet connections or permissions granted to the site through wallet settings and transfer remaining assets to a fresh, hardware-isolated wallet. Scan device storage for injected scripts or browser extensions added after the visit and consider a full browser reset or OS reinstall if malware indicators are detected. Report the encounter to PhishDestroy so the domain can be tracked and neutralized faster by the community.