x-meiterminal[.]xyz

This domain, x-meiterminal.xyz, has been identified as a crypto wallet drainer phishing site. Analysis indicates the infrastructure was specifically designed to impersonate cryptocurrency wallet interfaces, enabling unauthorized transaction signing and fund theft. The domain is currently offline, though historical activity suggests it was operational for a limited period targeting users of decentralized finance platforms. Infrastructure analysis reveals the domain was registered on May 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. Security vendors on VirusTotal flagged the domain at a rate of 5 out of 95, indicating moderate detection coverage. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain appears on four distinct security blocklists, including entries from cryptocurrency-focused threat intelligence sources. No associated IP addresses or hosting providers have been confirmed in available telemetry, though passive DNS records suggest ephemeral hosting patterns typical of phishing campaigns. Current assessment classifies this as an elevated-risk threat due to its targeted nature and potential for direct financial loss. While the domain is presently offline, similar infrastructure may re-emerge under different names. Organizations and individuals are advised to block the domain at the DNS level and monitor for related indicators. Cryptocurrency users should verify wallet interfaces through official sources only, enable transaction signing confirmation prompts, and review connected dApp permissions regularly. Security teams should correlate this domain with other known crypto drainer infrastructure to identify potential campaign linkages.