xpa03[.]top

xpa03.top is an active domain classified as a generic phishing host leveraging a cryptocurrency drainer kit to siphon funds from unwitting users. No specific brand is being spoofed at this time, indicating a broad opportunistic campaign rather than a targeted brand impersonation. The drainer payload has not yet been fully reverse-engineered, but telemetry suggests it automates wallet address substitution and transaction signing prompts to divert crypto transfers to attacker-controlled addresses. This domain was flagged by PhishDestroy on April 02, 2026, the same day it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.92.162 and is secured with a Let’s Encrypt SSL certificate, which is often abused to lend a false sense of legitimacy. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating it remains under the radar. The domain has not yet been added to Google Safe Browsing (GSB) and shows no presence on major public blocklists, which prolongs its window of opportunity. The threat remains active with no takedown or block action reported to date. Users should immediately block the domain at DNS or firewall level and avoid any interaction. The current risk is classified as under_investigation due to evolving payload behavior, but the lack of detections suggests a rapidly escalating danger. Security teams are advised to monitor for associated wallet addresses and update network defenses accordingly while awaiting further updates.