# xp25.top — SUSPICIOUS

> PhishDestroy identifies xp25.top as a credential theft lure. Zero VirusTotal engines detected the page as of March 25, 2025; registrar is NICENIC INTERNATIONAL.

## Summary
xp25.top is a recently registered domain that currently hosts a credential theft page. The site attempts to trick visitors into entering usernames and passwords by mimicking legitimate login interfaces. Once submitted, these credentials are harvested by attackers for account takeover and possible follow-on fraud such as crypto drainer attacks.


PhishDestroy flagged the domain after analyzing these key indicators: VirusTotal shows 0 out of 95 antivirus engines detected anything malicious at the time of assessment, yet the domain still resolves to IP 104.21.93.38 and was created on March 25, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its SSL certificate is issued by Let’s Encrypt, which does not by itself guarantee safety against credential phishing.


If you visited xp25.top and entered any credentials, change those passwords immediately on a different device or network, enable multi-factor authentication, and scan your accounts for unauthorized transactions. Do not reuse the same password on other sites. Report any suspicious login attempts to the affected brand and consider revoking any API keys or tokens that may have been exposed.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-25 07:33:00
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.93.38

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/5cb008a2-6ff0-43f7-a077-140ff6cdd12c
- PhishDestroy: https://phishdestroy.io/domain/xp25.top/
- LLM endpoint: https://phishdestroy.io/domain/xp25.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xp25.top/
Last updated: 2026-03-26