origindefii[.]xyz

The domain origindefii.xyz was registered on 13 March 2026 through OwnRegistrar, Inc. and is presently flagged as a high‑risk crypto‑drainer campaign. The site presents a generic page title identical to the domain name and serves HTTP content with a 200 response, indicating an active web presence. Its SSL certificate is issued by Let’s Encrypt, confirming that transport encryption is in place but does not mitigate the underlying malicious intent.

Infrastructure analysis shows that origindefii.xyz resolves to the IP address 209.182.227.163, which belongs to AS395092 (Shock Hosting LLC) in the United States. The domain is delegated to the authoritative name servers dns1.webproserver.com and dns2.webproserver.com. An MX record with priority 0 points to origindefii.xyz itself, a configuration commonly observed in fraudulent domains that aim to control inbound mail flow.

The domain appears on four independent security blocklists and has been blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, reinforcing the consensus that it participates in cryptocurrency‑related fraud. VirusTotal reports that five of ninety‑five scanned security vendors flag the domain, and Gridinsoft assigns a trust score of zero out of one hundred, indicating a lack of benign reputation. These signals collectively corroborate the classification as a crypto‑drainer site.

Defenders should block DNS resolution for origindefii.xyz at the network perimeter and enforce URL filtering to prevent user access. Email gateways should reject or quarantine messages addressed to the domain’s MX host, as the self‑referencing MX may be leveraged for phishing attempts. Continuous monitoring of the associated IP address and name servers is advised, and any newly observed activity should be reported to threat‑sharing platforms to aid collective mitigation.