xp25[.]top

xp25.top is a recently registered domain that currently hosts a credential theft page. The site attempts to trick visitors into entering usernames and passwords by mimicking legitimate login interfaces. Once submitted, these credentials are harvested by attackers for account takeover and possible follow-on fraud such as crypto drainer attacks.

PhishDestroy flagged the domain after analyzing these key indicators: VirusTotal shows 3 out of 95 antivirus engines detected anything malicious at the time of assessment, yet the domain still resolves to IP 104.21.93.38 and was created on March 25, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its SSL certificate is issued by Let’s Encrypt, which does not by itself guarantee safety against credential phishing.

If you visited xp25.top and entered any credentials, change those passwords immediately on a different device or network, enable multi-factor authentication, and scan your accounts for unauthorized transactions. Do not reuse the same password on other sites. Report any suspicious login attempts to the affected brand and consider revoking any API keys or tokens that may have been exposed.