cxping[.]xyz

The domain cxping.xyz has been identified as a cryptocurrency drainer phishing infrastructure, currently marked as offline. Analysis indicates the site impersonated a cryptocurrency-related service, likely targeting users with wallet-draining malware under the guise of a legitimate platform. The page title 'CEXPing' suggests an attempt to mimic established cryptocurrency exchange or monitoring services, though no direct brand impersonation has been confirmed. Infrastructure analysis reveals the domain was registered on March 28, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with newly observed phishing domains. It resolves to the IP address 63.176.8.218 and employs technologies such as Netlify and HSTS, which may have been leveraged to enhance perceived legitimacy. Security vendors on VirusTotal flagged the domain, with 4 of 95 engines detecting malicious activity. The domain appears on one security blocklist and holds a trust score of 0/100, further corroborating its malicious classification. Additional indicators include its inclusion in the PhishDestroy blocklist and a Gridinsoft trust assessment confirming high-risk status. As of the latest verification, cxping.xyz has been taken offline, though residual risks may persist if associated infrastructure remains active. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure. Users who may have interacted with the domain should assume credential or wallet compromise and take immediate remediation steps, including revoking active sessions, rotating passwords, and auditing transaction histories for unauthorized activity.