xa20r[.]com

PhishDestroy identifies xa20r.com as an active crypto drainer phishing domain hosting a fake login portal. The domain is currently live and leverages a Let’s Encrypt SSL certificate to appear trustworthy. xa20r.com impersonates a well-known cryptocurrency platform without the platform’s consent, tricking users into entering credentials or wallet details. This domain was flagged by 11 of 95 VirusTotal security vendors, indicating elevated detection without universal consensus. The Let’s Encrypt certificate (issuer: CN=R3, O=Let’s Encrypt, C=US) was issued to xa20r.com, which shares infrastructure with previously reported malicious domains. Creation date: 2024-03-15. Registrar: Namecheap, Inc. Current IP: 185.178.45.82. Domain age: ~2 months. Blocklist count: 14 public blocklists. Trust scores: Netcraft -62, OpenPhish -9.9. PhishDestroy marks xa20r.com with elevated risk due to active crypto drainer activity. Users should avoid all links to xa20r.com and verify any similar domains using PhishDestroy’s real-time scanner. If you’ve visited this domain, disconnect your wallet, revoke unauthorized permissions, and run a malware scan immediately. Report the domain to PhishDestroy to help protect the community.