xentrapop[.]top

This domain, xentrapop.top, is currently under investigation for generic phishing activity, with a focus on potential crypto wallet or credential harvesting schemes. Analysis indicates no explicit brand impersonation or known drainer kit signatures at this time, though the infrastructure aligns with common phishing patterns observed in financial fraud campaigns. The domain lacks immediate red flags such as typosquatting or homoglyphs but exhibits characteristics typical of newly deployed phishing endpoints designed to evade detection during initial deployment phases. Technical indicators reveal the following: the domain resolves to IP address 95.129.232.126 and was registered on June 30, 2026, through registrar GLOBAL ASSET DOMAINS INC. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged or analyzed. Google Safe Browsing status remains unconfirmed, and no entries exist on major blocklists or threat intelligence feeds as of the latest scan. The creation date, set in the future (2026), may indicate an attempt to bypass automated age-based filtering or could be a clerical error in registration data. Current status remains active, with no takedown requests or sinkholing observed. Response actions include ongoing monitoring for malicious payload delivery, credential harvesting scripts, or integration with known phishing kits. Users are advised to treat this domain as high-risk until further analysis confirms its intent. Network defenders should implement DNS-based blocking for 95.129.232.126 and monitor for connections to xentrapop.top in logs. Crypto wallet users should verify transaction requests independently and avoid entering recovery phrases or private keys on unfamiliar sites, regardless of apparent legitimacy.