89447[.]xyz

This domain is flagged as a high-risk crypto wallet drainer, designed to exfiltrate cryptocurrency assets through deceptive transaction prompts. Analysis indicates the infrastructure targets users of decentralized finance platforms, employing social engineering tactics to trick victims into authorizing malicious smart contract interactions. The domain exhibits characteristics consistent with advanced phishing operations, including the use of modern web technologies to evade detection and enhance credibility. Infrastructure analysis reveals the domain 89447.xyz resolves to the IP address 103.27.177.163 and was registered on January 31, 2026, through Gname.com Pte. Ltd. The domain is currently active and employs several technologies to obfuscate its malicious intent, including Vue.js for dynamic content rendering, Nginx as the web server, HSTS for forced HTTPS connections, and Cloudflare for traffic proxying and DDoS protection. The SSL certificate is issued by Let's Encrypt, a common tactic to feign legitimacy. As of the latest assessment, 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating moderate detection coverage but persistent evasion capabilities. Mitigation against this crypto wallet drainer requires heightened user awareness and technical safeguards. Users should verify domain authenticity before interacting with any cryptocurrency-related prompts, particularly those requesting wallet connections or transaction approvals. Browser-based security extensions that block known phishing domains should be employed, and wallet software should be configured to require explicit approval for all smart contract interactions. Network-level protections, such as DNS filtering or firewall rules blocking the IP 103.27.177.163, can provide additional defense. Organizations should monitor for connections to this domain and IP within their networks and update blocklists accordingly. Given the domain's use of Cloudflare, reliance on IP-based blocking alone may be insufficient, necessitating multi-layered detection strategies.