xzhcxml[.]proklain[.]com

This domain is flagged as a high-risk phishing infrastructure specifically designed for cryptocurrency credential harvesting. Analysis indicates the site mimics legitimate wallet interfaces to extract private keys, seed phrases, or login credentials from unsuspecting users. The threat type aligns with targeted attacks against decentralized finance (DeFi) platforms and self-custody wallet users, where stolen credentials can lead to immediate, irreversible asset theft. Infrastructure analysis reveals the domain xzhcxml.proklain.com was registered on February 21, 2026, through Dynadot LLC and currently resolves to IP address 172.67.177.198. The site employs Cloudflare services, including HTTP/3 support, and integrates Facebook Pixel tracking technology, suggesting attempts to profile victims. Security vendors flagged the domain with 12/95 detections on VirusTotal, while it appears on three distinct security blocklists. Gridinsoft assigns a trust score of 0/100, and the domain has been blocked by multiple cryptocurrency security tools. The page title remains undefined, a common indicator of hastily deployed phishing kits. Mitigation requires immediate action from both end users and network administrators. Users should verify domain authenticity before entering any credentials, particularly when prompted by unsolicited links. Wallet software extensions and security tools that block known phishing domains should be enabled and kept updated. Network-level protections should include DNS filtering to prevent resolution of this domain and its associated IP. Given the domain's current offline status, monitoring for re-emergence under similar naming patterns or IP ranges is recommended. Organizations should add this domain and its indicators to threat intelligence feeds for proactive detection.