dexpiro[.]net

This domain, dexpiro.net, is identified as a credential theft operation targeting cryptocurrency users. Analysis indicates the site impersonates a legitimate wallet service, likely aiming to harvest private keys or recovery phrases. The infrastructure exhibits characteristics typical of crypto drainer campaigns, where victims are tricked into entering sensitive credentials under false pretenses. No direct association with a known drainer kit has been confirmed, but the domain’s behavior aligns with common credential theft tactics observed in recent phishing incidents. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 22, 2026, through Gname.com Pte. Ltd., a registrar frequently used in fraudulent registrations. It resolves to the IP address 188.114.96.3, which has been linked to other malicious activities. VirusTotal reports a detection rate of 1 out of 95 security vendors, indicating limited but present recognition of its malicious nature. The domain appears on three security blocklists and is actively blocked by platforms such as MetaMask and SEAL. Google Safe Browsing (GSB) status is not explicitly provided, but the blocklist presence suggests it is flagged by major threat intelligence feeds. As of the latest assessment, dexpiro.net has been taken offline, reducing immediate exposure to potential victims. However, the domain’s infrastructure remains a latent risk, as threat actors may reactivate it or migrate to a new domain under the same registrar. Users who interacted with the site should immediately revoke any connected wallet permissions and monitor accounts for unauthorized transactions. Organizations are advised to update blocklists to include this domain and its associated IP address to prevent future access. Given the elevated risk level, continued vigilance is recommended, particularly for users who may have engaged with the site prior to its takedown.