xcomwallet[.]finance

Analysis of the domain xcomwallet.finance indicates that it is part of a crypto‑drainer operation. The site was registered on 27 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to 172.67.190.45, an IP address assigned to Cloudflare in the United States. The domain uses the Cloudflare nameservers aryanna.ns.cloudflare.com and cleo.ns.cloudflare.com, but no TLS certificate was observed, meaning HTTPS connections would be unencrypted or unavailable. The page title returned by the server is “X Wallet”, and the listed scam type in intelligence is “Crypto Scam”.

VirusTotal scans show that four of ninety‑five security vendors flagged the domain, confirming malicious intent. The domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy service. The infrastructure appears to have been taken offline at the time of this assessment, but the registration and hosting details remain valid. Defenders should treat any traffic to xcomwallet.finance as hostile. Blocking the domain at the DNS or firewall level is recommended, as is adding the associated IP 172.67.190.45 to deny lists.

Because the domain leverages Cloudflare’s shared infrastructure, threat‑hunters should monitor for other subdomains that resolve to the same IP range and consider correlating alerts with the “X Wallet” page title. Continuous re‑scanning with VirusTotal or similar multi‑engine services is advised to capture any changes in vendor detections. Organizations that handle cryptocurrency assets should especially enforce strict verification of wallet addresses and educate users that the “X Wallet” branding is not a legitimate service. Until the site is definitively taken down, maintain active monitoring of the registrar NiceNIC and the Cloudflare nameservers for new domains that may reuse the same registration patterns.