y97y[.]xyz

This domain, y97y.xyz, operates as a crypto drainer phishing site designed to steal digital wallet credentials and drain cryptocurrency assets. Analysis indicates the site impersonates legitimate wallet interfaces or transaction portals, tricking users into entering private keys or seed phrases. Once compromised, funds are irreversibly transferred to attacker-controlled addresses, leading to immediate financial loss. The threat is particularly insidious due to its targeted nature and the irreversible nature of blockchain transactions. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered on September 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk registrations. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, with detections spanning phishing, fraud, and crypto-related threats. The site resolves to IP address 103.59.145.120, hosted under AS133861 (SonderCloud Limited), an autonomous system with a history of hosting phishing infrastructure. The SSL certificate, issued to 'Default Company Ltd,' further signals a lack of legitimate identity validation, a common trait in phishing operations. If you visited y97y.xyz or entered any sensitive information, immediate action is required. First, disconnect the affected device from the internet to prevent further data exfiltration. Revoke any active wallet sessions and transfer remaining assets to a new, secure wallet using a different device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where possible. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities. Given the domain's elevated risk level and offline status, remain vigilant for follow-up attacks, such as phishing emails or malware distribution, targeting the same credentials.