xa46g-cointelegraph[.]com

This domain, xa46g-cointelegraph.com, is flagged as a crypto brand impersonation threat designed to deceive users into divulging credentials or sensitive information. Analysis indicates the domain mimics legitimate cryptocurrency news platforms, likely leveraging trusted branding to facilitate credential theft or unauthorized transactions. No direct evidence of a drainer kit was observed, but the infrastructure aligns with known phishing campaigns targeting crypto-related audiences.

Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and has been flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was included in a single threat intelligence pulse on AlienVault OTX. Google Safe Browsing (GSB) status is not explicitly confirmed, but the domain is currently offline, likely due to takedown efforts.

As of the latest assessment, xa46g-cointelegraph.com has been taken offline, reducing immediate exposure risk. However, residual threats may persist if credentials were previously harvested or if the domain is reactivated under a different infrastructure. Organizations and users are advised to monitor for unauthorized access attempts linked to this domain, reset credentials associated with crypto-related services, and implement multi-factor authentication (MFA) to mitigate potential fallout from credential theft.