xcoinmarket[.]io

The domain xcoinmarket.io is a phishing site engaged in brand impersonation targeting Binance users. It presents itself as a cryptocurrency wallet service under the name 'X Wallet' but is designed to deceive victims into disclosing login credentials or transferring funds. No drainer kit was observed, though the site poses an elevated risk due to its fraudulent representation of a major exchange. As of the latest verification, xcoinmarket.io has been taken offline.

Technical indicators confirm the malicious nature of xcoinmarket.io. The domain was registered on 2026-02-21 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal flagged it with 2 of 95 detections, including alerts from Gridinsoft (trust score 1/100) and SOCRadar. The domain appears on 3 security blocklists, specifically PhishDestroy, MetaMask, and SEAL. No SSL certificate was issued, and the site used Cloudflare Browser Insights and HTTP/3 technologies. Nameservers are clarissa.ns.cloudflare.com and ryan.ns.cloudflare.com.

Users who interacted with xcoinmarket.io should immediately change their Binance account passwords and enable two-factor authentication to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or logins. If cryptocurrency was transferred, consider moving remaining funds to a new wallet, though recovery of lost assets is unlikely. Report the domain to Binance's official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.