xdcnetwork[.]live

This domain, xdcnetwork.live, is flagged as a generic phishing site targeting cryptocurrency wallet users. Analysis indicates no direct association with a known brand or drainer kit at this stage, though the domain name mimics the legitimate XDC Network to deceive users into disclosing private keys or seed phrases. The infrastructure appears designed for credential harvesting under the guise of a blockchain-related service, a common tactic in crypto-focused phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.142.180. The SSL certificate is issued by Google Trust Services, and the site employs HSTS, Cloudflare, and HTTP/3 technologies, which are frequently leveraged to obfuscate malicious activity. Despite these red flags, the domain has a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious at the time of analysis. It appears on one security blocklist and is currently blocked by a specialized phishing detection system. The domain is presently offline, likely due to takedown actions or voluntary suspension by the hosting provider. However, the risk of re-emergence remains, as threat actors often re-deploy phishing infrastructure under new domains or IPs. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate private keys, and monitor for unauthorized transactions. Organizations are advised to proactively block the domain and associated IP in perimeter defenses to prevent future access attempts. Continuous monitoring of newly registered domains with similar naming patterns is recommended to mitigate further exposure.