incomplete-x[.]com

This domain, incomplete-x.com, is actively flagged as a high-risk crypto drainer phishing site. Infrastructure analysis reveals it is hosted behind Cloudflare (104.21.60.78, AS13335), utilizing nameservers jaziel.ns.cloudflare.com and macy.ns.cloudflare.com, which is consistent with threat actors leveraging Cloudflare’s proxy services to obscure origin servers. The domain was registered on April 17, 2026, through Dynadot Inc, and remains operational as of July 12, 2026, despite being blocked by multiple security vendors, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing has classified the domain under SOCIAL_ENGINEERING, and 11 of 94 security vendors on VirusTotal have detected malicious activity, reinforcing its classification as a confirmed threat. The page title, pointing to a YouTube video URL (https://www.youtube.com/watch?v=dQw4w9WgXcQ), suggests an attempt to deceive users by redirecting or embedding content that may appear legitimate, though the exact mechanics of the scam remain unconfirmed without further analysis. The domain employs reCAPTCHA and Cloudflare Browser Insights, likely to evade automated detection and gather telemetry on victims. The HTTP status code 530 indicates a Cloudflare-specific error, which may result from misconfigured threat actor infrastructure or active mitigation efforts. Defenders should treat this domain as an active crypto drainer threat. The combination of Cloudflare proxying, recent registration, and multiple security vendor detections warrants immediate blocking at the DNS, IP, and network levels. Further investigation into associated wallet addresses, redirect chains, or linked domains is recommended to disrupt the broader campaign. Given the domain’s persistence despite blocklist inclusion, monitoring for new resolving IPs or certificate renewals may help preempt evasion attempts.