app-apyxfi[.]xyz

This domain is flagged as an elevated-risk crypto drainer, a specialized phishing threat designed to deplete cryptocurrency wallets by tricking users into signing malicious transactions. Analysis indicates the domain targets users through deceptive interfaces that mimic legitimate decentralized finance (DeFi) platforms, enabling unauthorized transfers of digital assets upon interaction with embedded smart contracts or approval prompts. The threat type is classified as a crypto drainer due to its direct financial exfiltration mechanism, distinguishing it from broader credential theft or brand impersonation schemes.

Infrastructure analysis reveals the domain app-apyxfi.xyz was registered on June 12, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 104.21.19.52, which has been observed in prior phishing campaigns. Detection metrics indicate the domain is flagged by 5 out of 95 security vendors on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL, further corroborating its malicious classification. The creation date, combined with the rapid inclusion on blocklists, suggests a short-lived but high-impact campaign targeting cryptocurrency users.

Mitigation against this crypto drainer threat requires immediate action from both end-users and security teams. Users must verify domain authenticity before interacting with any DeFi platform, particularly those prompting wallet connections or transaction approvals. Wallet software should be configured to reject unsolicited connection requests, and hardware wallets should be used for high-value transactions to mitigate signature-based attacks. Security teams are advised to implement network-level blocking for the domain and its resolving IP address (104.21.19.52) across all endpoints. Additionally, monitoring for domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED with similar naming patterns (e.g., app-[randomstring].xyz) can preemptively disrupt related campaigns. Educational initiatives should emphasize the risks of signing unverified smart contract interactions, as this remains the primary vector for crypto drainer exploitation.