xgalaxymetaverse[.]com

This domain, xgalaxymetaverse.com, is currently under investigation for brand impersonation targeting Aave, a decentralized finance protocol. The site presents itself as an allocation claim portal for XMETA and NFT distributions, a tactic commonly associated with credential harvesting or crypto drainer schemes. As of the latest assessment, the domain remains active and unblocked by security vendors, posing a potential risk to users interacting with Aave-related services. Infrastructure analysis reveals the domain was registered on July 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious campaigns. It resolves to the IP address 188.114.97.3, which has not been flagged in public blocklists at the time of this report. VirusTotal scanning indicates zero detections out of 95 security vendors, suggesting the domain has not yet been widely recognized as malicious. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy while the page title explicitly references an "XMETA & NFT Allocation Claim Portal," a lure designed to exploit user interest in token distributions. The current status of xgalaxymetaverse.com remains active, with no evidence of takedown or mitigation efforts. Users are advised to exercise extreme caution when encountering this domain, particularly if prompted to connect wallets or input credentials. Organizations should monitor for references to this domain in logs and consider preemptive blocking at the network level. Security teams are encouraged to submit the domain for further analysis to threat intelligence platforms to improve detection coverage and protect potential victims from credential theft or financial loss.