top-chainwallet[.]xyz

This domain, top-chainwallet.xyz, was created on 2026-03-06 and is currently taken offline. It resolves to 198.251.81.49, an address assigned to AS53667 FranTech Solutions in the United States. The authoritative nameservers are ns104.my-control-panel.com and ns103.my-control-panel.com, and the domain’s MX record points to mail.top-chainwallet.xyz with priority 10. The site presented a page titled “BulkMailer Pro - Login”, which aligns with the reported crypto drainer scam type. TLS termination is provided by a Let's Encrypt certificate (issuer E8), indicating a valid but low‑cost certificate commonly abused by malicious actors.

VirusTotal has flagged the domain in 7 of 94 scanners, and the domain appears on three independent security blocklists. Additional blocking is confirmed by PhishDestroy, MetaMask, and SEAL. Registration was performed through Atak Domain Bilgi Teknolojileri A.Ş., a Turkish registrar. The risk level is elevated. Analysis indicates that the infrastructure—single IP, generic control‑panel nameservers, and a public‑trusted certificate—matches patterns observed in recent crypto‑drainer campaigns.

However, the actual payload, credential‑stealing mechanisms, and any associated command‑and‑control endpoints remain undocumented; the only observed indicator is the page title. No public Safe Browsing or Open Threat Exchange entries are available for this domain. Defenders should immediately add top-chainwallet.xyz to DNS and web‑filter block lists, enforce outbound filtering of traffic to 198.251.81.49, and configure email gateways to reject mail directed to the MX host. Continuous monitoring of the registrar’s WHOIS records and the IP address for re‑registration or new activity is advised. Integrating the VirusTotal detection count and blocklist sightings into SIEM correlation rules will improve early detection of any resurgence.