# xpm6.top — SUSPICIOUS

> Warning: xpm6.top hosts a fake $USDC token airdrop phishing scam. Avoid sharing personal info or crypto keys. Site is offline but stay cautious.

## Summary
PhishDestroy identifies xpm6.top as a low-risk phishing domain impersonating a $USDC token airdrop. Although the domain is currently offline, it previously attempted to lure users with the promise of free cryptocurrency tokens, a common tactic used to steal sensitive information. Users should remain vigilant, as these scams exploit trust in popular crypto assets to trick victims.

This phishing attempt worked by presenting a webpage titled "$USDC Token Airdrop" which likely asked visitors to provide private keys, wallet credentials, or personal data under the guise of receiving free USDC tokens. The domain was flagged on multiple security blocklists and received a very low trust score, indicating suspicious activity. The site's registration data and IP address further support its fraudulent nature.

If anyone visited xpm6.top, they should immediately cease any communication or transactions linked to it. Users are advised to change passwords or wallet keys if they entered any credentials and monitor their accounts for unauthorized activity. Employing antivirus scans and enabling two-factor authentication can help mitigate further risk. Always verify airdrop legitimacy through official channels to avoid falling victim to similar scams.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: $USDC Token Airdrop

## Domain Intelligence
- Registered: 2026-03-05 19:07:02
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: fonzie.ns.cloudflare.com rita.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Fortinet", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbf4f-3f54-77d4-be4a-6fca515911c8.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/xpm6.top
- PhishDestroy: https://phishdestroy.io/domain/xpm6.top/
- LLM endpoint: https://phishdestroy.io/domain/xpm6.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xpm6.top/
Last updated: 2026-03-19