xalienslabs[.]info

This domain, xalienslabs.info, operates as a fraudulent token claim allocation portal targeting cryptocurrency users. The site mimics legitimate airdrop or genesis claim portals, presenting itself under the title 'xAliens Genesis — Claim Allocation Portal' to deceive victims into submitting wallet credentials or private keys. Analysis indicates the domain is designed to harvest sensitive authentication details, enabling unauthorized access to digital assets. The threat specifically exploits users expecting legitimate token distributions, increasing the likelihood of successful credential theft. Infrastructure analysis reveals the domain was registered on July 03, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with high-risk domains. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flagged this domain, suggesting limited detection coverage and potential evasion of automated defenses. The domain resolves to IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, providing a false sense of security to visitors. No known blocklist entries exist beyond the single vendor detection, indicating a need for proactive monitoring. Users who visited xalienslabs.info should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. Monitor connected accounts for unauthorized transactions and enable multi-factor authentication where available. Security teams should add the domain, IP 188.114.96.3, and associated SSL certificate fingerprints to network blocklists. If credentials were entered, assume compromise and rotate all exposed secrets. Report the domain to relevant abuse contacts and threat intelligence platforms to support broader detection efforts.