xpr2p[.]top

PhishDestroy identifies xpr2p.top as an ACTIVE crypto drainer under investigation, hosting malicious scripts designed to steal cryptocurrency wallet credentials and drain funds from unsuspecting users. This domain operates with deceptive intent, masquerading as legitimate services to trick victims into connecting wallets or entering private keys. The threat is classified as a high-risk generic phishing attack leveraging crypto-scam tactics, where attackers exploit user trust to facilitate irreversible fund transfers.

This domain exhibits multiple red flags consistent with fraudulent operations. VirusTotal analysis shows 3 out of 95 antivirus engines detecting malicious activity, indicating it has evaded automated scanning systems despite its active threat status. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domains. The domain resolves to IP address 188.114.96.3, which is associated with cloud hosting infrastructure commonly abused by scammers due to its low-cost and anonymous registration policies. Registered on April 27, 2026, this domain is extremely new, a characteristic often exploited by threat actors to avoid historical blocklists. Currently, it remains undetected on major threat intelligence feeds, amplifying the risk of exposure to unaware users.

To mitigate this threat, users must never interact with xpr2p.top or any linked platforms requesting wallet connections or private key input. Always verify URLs via trusted sources such as PhishDestroy before engaging. Scan downloads for malware using reputable antivirus tools. Use hardware wallets and never enter seed phrases on websites. Report suspicious domains immediately to blocklist authorities. Given the crypto drainer nature, assume interaction leads to fund loss.