app[.]firstbatch[.]xyz

This domain, app.firstbatch.xyz, is flagged as a crypto-focused phishing endpoint designed to impersonate the legitimate FirstBatch platform. Analysis indicates the site was structured to harvest cryptocurrency wallet credentials or private keys, likely targeting users of FirstBatch’s token-based services. No specific drainer kit signatures were conclusively identified, but the domain’s infrastructure and page title alignment suggest a deliberate attempt to deceive users into disclosing sensitive authentication details. Infrastructure analysis reveals the domain was registered through NAMECHEAP INC on February 22, 2022, and resolved to the IP address 66.33.60.35. At the time of assessment, the domain was detected by 6 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. The domain appears on a single security blocklist, and its Gridinsoft trust score is 0/100, reflecting a high-risk classification. The SSL certificate was issued by Let’s Encrypt, and the site employed HSTS alongside Vercel hosting, which may have been leveraged to lend an appearance of legitimacy. As of the latest verification, app.firstbatch.xyz has been taken offline, likely in response to detection by security mechanisms such as PhishDestroy. While the immediate threat has been mitigated, residual risk persists due to the domain’s historical activity and potential for re-emergence under altered infrastructure. Users who interacted with the site prior to its takedown are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the authenticity of any communications claiming affiliation with FirstBatch. Ongoing vigilance is recommended, as phishing operators frequently reuse tactics across new domains.