claim-genius[.]xyz

This domain, claim-genius.xyz, operates as a crypto drainer designed to compromise digital wallet credentials and automatically siphon cryptocurrency assets without user consent. Analysis indicates the site impersonates a legitimate crypto trading platform, using deceptive branding elements such as the title 'Genius Points • Trade Crypto Like a Genius' to lure victims into connecting their wallets. Once a user interacts with the site, embedded malicious JavaScript executes unauthorized transactions, draining funds to attacker-controlled addresses. The threat primarily targets users of browser-based wallet extensions, exploiting their trust in seemingly authentic trading interfaces. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. It currently resolves to the IP address 188.114.96.3 and is flagged by 6 out of 95 security vendors on VirusTotal, including detection as a crypto drainer. Additionally, the domain appears on three security blocklists and is actively blocked by multiple wallet security tools, further confirming its malicious intent. The SSL certificate issued by Google Trust Services provides a false sense of security, as encrypted connections do not mitigate the underlying threat posed by the site's scripts. Users who have visited claim-genius.xyz or interacted with its content should take immediate action to secure their assets. First, disconnect any wallets linked to the domain and revoke all associated smart contract approvals using a trusted blockchain explorer. Next, scan the device for malware, as crypto drainers may deploy additional payloads to maintain persistence. Monitor all connected wallets for unauthorized transactions and transfer remaining funds to a new, secure wallet address. If assets were compromised, report the incident to relevant blockchain analytics platforms and local cybercrime authorities, providing transaction hashes and any interaction logs as evidence. Vigilance is critical, as crypto drainers often employ social engineering tactics to re-target victims through phishing emails or fake recovery services.