xuniqianbaogf[.]com[.]cn

Domain xuniqianbaogf.com.cn has been identified as a crypto drainer scam, a specific type of phishing threat designed to steal cryptocurrency wallet credentials and drain funds. The site, now offline, impersonated a legitimate digital wallet service under the Chinese title "虚拟钱包 - 安全便捷的数字支付解决方案" (Virtual Wallet - Safe and Convenient Digital Payment Solution). This domain was flagged by 17 of 95 security vendors on VirusTotal, indicating broad consensus among the security community on its malicious nature. It also appeared on one security blocklist and was tracked in five AlienVault OTX threat intelligence pulses, showing that threat analysts had been monitoring its activity.

The domain was created on May 24, 2026, and resolved to IP address 154.194.136.109. It used an SSL certificate issued by Let's Encrypt (type E8), a common choice among fraudulent sites due to its free and automated issuance. Despite its recent creation and offline status, the domain's registration details and hosting infrastructure remain indicators of the threat actor's infrastructure. The site's title and design aimed to deceive users into believing they were interacting with a secure financial platform, while in reality, it would have captured sensitive wallet information.

Since the domain is now offline, the immediate risk of interaction is low. However, users who may have visited the site or entered credentials should take immediate action. PhishDestroy recommends changing any passwords or recovery phrases associated with wallets entered on the site, enabling two-factor authentication on all cryptocurrency accounts, and monitoring wallet addresses for unauthorized transactions. Furthermore, users should avoid clicking on links from unsolicited messages or emails promoting similar wallet services, and always verify domain names directly with official sources before entering sensitive information.