vote-xpmarket[.]xyz

This domain, vote-xpmarket.xyz, operates as a crypto drainer phishing site designed to deceive users into connecting cryptocurrency wallets under the pretense of claiming XRP rewards. Analysis of the site’s content reveals a fabricated XRP Reward Center interface, complete with prompts to link wallets to a malicious smart contract. Once connected, the site executes unauthorized transactions, draining funds from victims’ wallets without consent. The threat specifically targets users of the XRP Ledger (XRPL), exploiting trust in reward-based promotions to facilitate financial theft. Infrastructure analysis indicates the site employs obfuscated JavaScript to mask its malicious payload, a common tactic in crypto drainer schemes. Technical indicators confirm the domain’s fraudulent nature. VirusTotal reports 2 out of 95 security vendors flagging vote-xpmarket.xyz as malicious, a low detection rate that underscores the site’s evasion techniques. The domain was registered on June 8, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), which provides anonymity and resilience against takedowns. The domain appears on four security blocklists, including PhishDestroy and ScamSniffer, further validating its classification as a threat. The SSL certificate, issued by Google Trust Services, lends a false sense of legitimacy while failing to mitigate the underlying risk. Users who have visited vote-xpmarket.xyz or interacted with its content should take immediate action to secure their assets. Disconnect any wallets linked to the site and revoke permissions for all associated smart contracts using a blockchain explorer. Monitor transaction histories for unauthorized activity and transfer remaining funds to a new, secure wallet. If credentials were entered, assume they are compromised and avoid reusing them across platforms. Report the domain to relevant security communities and consider submitting it to additional blocklists to prevent further exploitation. Given the high-risk nature of crypto drainers, proactive measures are critical to mitigating potential losses.