xdago[.]bet

PhishDestroy identifies xdago.bet as an ACTIVE crypto drainer deployment domain under investigation for actively harvesting cryptocurrency wallet credentials and assets via fake transaction portals. The domain leverages a recently registered infrastructure with low detection coverage, suggesting an emerging threat campaign targeting crypto users. Technical indicators reveal a Let's Encrypt SSL certificate, a PDR Ltd. registration, and hosting on ASN 13335 (Cloudflare). This combination enables HTTPS deception while obscuring true ownership. Immediate blocking and user caution are advised due to high risk of irreversible asset loss.

This domain was flagged as a generic phishing vector with 7 out of 95 VirusTotal detections as of investigation time, indicating minimal detection by security vendors. Domain creation occurred on February 23, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 188.114.96.3, hosted within Cloudflare’s infrastructure. The SSL certificate issued by Let's Encrypt adds a false veneer of legitimacy to crypto-themed landing pages designed to mimic legitimate wallet interfaces or exchange login portals.

Mitigation requires immediate domain blocking at DNS and network levels due to confirmed crypto drainer functionality. Users should avoid accessing xdago.bet or any subdomains and verify destination URLs via official channels before entering wallet credentials or initiating transactions. Security teams should flag the IP 188.114.96.3 and domain across corporate blocklists. Monitor for related domains registered post-February 2026 with similar naming patterns. Report any observed wallet interactions to crypto exchange support teams and consider revoking exposed credential pairs. Always use hardware wallets and verify site authenticity via blockchain explorer redirects or official app links.