xpm6[.]top

This domain, xpm6.top, operates as a fraudulent airdrop scheme targeting cryptocurrency users. It presents itself as a legitimate USDC token distribution platform, using social engineering tactics to deceive visitors into connecting their digital wallets or disclosing private keys. The site specifically exploits the popularity of USDC, a widely recognized stablecoin, to lure victims with promises of free tokens. Once accessed, the domain likely deploys malicious scripts or phishing forms to harvest sensitive credentials, enabling unauthorized access to victims' cryptocurrency holdings. The threat primarily affects users engaged in decentralized finance (DeFi) or those actively seeking airdrop opportunities, with financial loss as the immediate consequence. Analysis indicates the domain was registered on March 5, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. At the time of assessment, the domain resolved to the IP address 188.114.96.3 and was flagged by 6 out of 95 security vendors on VirusTotal. Additionally, it appeared on three distinct security blocklists, further corroborating its malicious nature. The domain's trust score of 0/100 from Gridinsoft underscores its lack of legitimacy. Infrastructure analysis reveals the domain was taken offline, though similar threats often re-emerge under different names or IP addresses. If you visited xpm6.top or interacted with its content, immediate action is required to mitigate potential damage. First, disconnect any wallets or devices that were connected to the site and revoke all active sessions or permissions granted to unknown applications. Scan the affected device using updated security tools to detect and remove any malware or unauthorized scripts. Monitor all linked accounts, including cryptocurrency wallets and exchange platforms, for unauthorized transactions. If credentials were entered, transfer assets to a new, secure wallet and update passwords for all associated accounts. Report the incident to relevant financial platforms and consider filing a complaint with cybersecurity authorities to aid in tracking and disrupting the threat actor's infrastructure.