xstocksfi-cla1m[.]com

This domain, xstocksfi-cla1m.com, is identified as a crypto drainer phishing site targeting users of tokenized equities platforms. The page title, 'xStocks - Tokenized Equities,' suggests an attempt to impersonate legitimate financial services offering blockchain-based equity trading. No specific drainer kit signatures were confirmed, but the domain aligns with known patterns of malicious infrastructure designed to siphon cryptocurrency assets from victims via fraudulent wallet interactions or fake investment portals.

Technical analysis reveals the following indicators: the domain is flagged by 3 out of 95 security vendors on VirusTotal, with a registrar identified as NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.9.225, a Cloudflare-associated endpoint, and was registered on June 12, 2026, an anomalous future date likely indicative of falsified registration data. The domain appears on four security blocklists and is actively blocked by wallet security tools, including MetaMask and ScamSniffer. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing infrastructure.

As of the latest assessment, xstocksfi-cla1m.com has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure and registration details remain a concern, particularly given the falsified creation date and use of bulletproof hosting practices. Users who interacted with the domain prior to its takedown should assume potential compromise of wallet credentials or sensitive financial data. Monitoring for unauthorized transactions and revoking access to any connected wallets or applications is strongly advised. Organizations should update blocklists to include this domain and its associated IP address to prevent residual risk from cached DNS or proxy-based access attempts.