xm27[.]top

PhishDestroy identifies xm27.top as an active crypto drainer domain designed to impersonate a login portal, posing an elevated risk to users. This domain is currently classified as a generic phishing threat and remains operational with no known takedown actions reported. The threat involves credential harvesting or cryptocurrency theft through fraudulent authentication prompts, targeting unsuspecting victims through social engineering or malicious links. This domain was flagged by 2 of 95 VirusTotal security vendors, indicating limited but concerning detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 188.114.97.3, and was created on March 27, 2026. The domain utilizes a Let's Encrypt SSL certificate, which may lend a false sense of legitimacy to potential victims. Despite its recent creation, the low blocklist count and absence of widespread vendor detection suggest this threat may be newly emerging or operating under the radar. Due to the active status and elevated risk classification, users are strongly advised to avoid interacting with xm27.top entirely. If credentials or sensitive data were entered, immediately revoke access to affected accounts, change passwords, and monitor for unauthorized transactions. Security researchers should flag this domain in threat intelligence platforms and block both the domain and associated IP address at the network perimeter. PhishDestroy users can verify the safety status of this domain using seed 82d153 for accurate threat correlation.