xnx-xr[.]com

PhishDestroy identifies xnx-xr.com as a generic phishing domain currently active and under investigation for potential cryptocurrency drainer activity. The domain is not yet flagged by automated detection systems but exhibits multiple red flags consistent with malicious intent, warranting heightened scrutiny from security researchers and end-users alike.

This domain was flagged by PhishDestroy after being blocked by a single security blocklist. VirusTotal currently shows 0 detections out of 95 vendor engines, indicating the domain has not yet been widely recognized as malicious despite its recent registration. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED with a domain creation date of April 25, 2025, resolution to IP address 188.114.97.3, and use of a Google Trust Services SSL certificate. The domain has appeared on 1 security blocklist, suggesting early-stage malicious deployment with potential for rapid expansion across detection systems.

Given the active status of this domain, the absence of VirusTotal detections despite blocklisting, and the specific threat of cryptocurrency drainer activity, users are strongly advised to avoid interaction with xnx-xr.com. PhishDestroy recommends manual verification of any links or websites associated with this domain before engagement. Security researchers should monitor this domain for evolving threat behaviors while endpoint protection systems may need manual updates to include this indicator. Immediate reporting of any suspicious interactions with this domain to PhishDestroy is encouraged to aid in threat containment and prevention of further victimization.