layerwallets[.]xyz

This domain, layerwallets.xyz, is identified as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency assets from compromised wallets. Analysis indicates no direct brand impersonation, but the domain employs obfuscated JavaScript to interact with wallet browser extensions, draining funds upon user authorization. The unique seed 02b89c associates it with a known drainer kit variant, though specific kit attribution remains unconfirmed. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 13.248.169.48 and is registered through GMO Internet Group, Inc. d/b/a Onamae.com. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious. It appears on three security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by GoDaddy.com, and the site employs Node.js, Express, and Akamai Web Application Protector for hosting and traffic filtering. No Google Safe Browsing (GSB) listing is currently recorded. The domain remains active and poses an elevated risk to users interacting with cryptocurrency wallets. Response actions include immediate blocking by wallet security extensions and inclusion in threat intelligence feeds. Despite these measures, the domain continues to resolve and may evade detection through rapid infrastructure changes. Users are advised to verify wallet addresses manually, avoid interacting with unsolicited transaction prompts, and monitor wallet activity for unauthorized transfers. Organizations should update blocklists to include this domain and its associated IP address.