unlimitedtradingsession[.]xyz

unlimitedtradingsession.xyz was flagged as an active crypto drainer phishing domain by PhishDestroy’s domain intelligence pipeline. The site leverages malicious scripts to siphon cryptocurrency from victims’ wallets during transaction signing, a hallmark of modern crypto drainer kits. Risk level is currently under investigation but remains elevated due to active infrastructure and absence of blocklist coverage. PhishDestroy strongly recommends treating this domain as hostile and blocking all traffic to or from its resolved IP 198.251.84.236.

Technical analysis confirms the domain resolves to a single IPv4 address (198.251.84.236) hosted on infrastructure associated with cryptocurrency theft campaigns. The domain was created on January 17, 2026—less than 72 hours prior to this assessment—indicating a recently deployed threat actor asset. The registrar is Dynadot LLC, and the site holds a valid Let’s Encrypt SSL certificate, increasing perceived legitimacy while failing to prevent malicious payload delivery. Despite 0 detections across VirusTotal’s 95-engine sandbox, this aligns with the evasive nature of crypto drainers, which often bypass static detection until post-execution behavior is observed. No current presence on major blocklists (e.g., PhishTank, OpenPhish, URLVoid) was detected, suggesting early-stage deployment.

Users should immediately block unlimitedtradingsession.xyz at the network perimeter and DNS level using threat intelligence feeds or manually via hosts file or firewall rules. For organizations, implement browser isolation or script-blocking policies (e.g., uBlock Origin, NoScript) when accessing crypto platforms. Wallet users are urged to verify transaction payloads using air-gapped tools and revoke any unauthorized contract approvals via Etherscan or similar explorers. Report any encounters to PhishDestroy and your local CERT for ingestion into global threat databases.