core-origindefi[.]xyz

The domain core-origindefi.xyz has been identified as a crypto drainer threat, a type of phishing site specifically designed to steal cryptocurrency wallet credentials and drain funds. This domain is currently offline, indicating it may have been taken down or deactivated, but past visitors remain at risk. While no specific brand impersonation was detected, the page title 'Just a moment...' is commonly used by phishing kits to mimic legitimate verification processes, luring users into connecting their wallets.

Technical analysis reveals that core-origindefi.xyz is flagged by 3 out of 95 VirusTotal security vendors and appears on one security blocklist, indicating moderate detection among security tools. The domain was created on February 28, 2026, a very recent date consistent with a short-lived phishing campaign. It was registered through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. The domain resolves to IP address 188.114.96.3, which is linked to Cloudflare, commonly used to obfuscate the true hosting location. No SSL certificate was found, further suggesting the site was not legitimate.

Given that the domain is now offline, the immediate risk of credential theft has diminished, but users who may have visited the site earlier should take action. It is strongly recommended to check for any unauthorized transactions in connected wallets, revoke any permissions granted to the domain, and enable two-factor authentication. Users should only access DeFi platforms through official URLs and verify security certificates before connecting wallets. PhishDestroy advises ongoing monitoring of any accounts that may have been exposed to this threat.