xrparmytoken[.]world

This domain, xrparmytoken.world, is currently flagged as an active crypto-phishing infrastructure designed to harvest digital wallet credentials and private keys. Analysis indicates the site mimics legitimate cryptocurrency platforms, leveraging social engineering tactics to deceive users into disclosing sensitive authentication details. The domain specifically targets individuals engaging with decentralized finance (DeFi) protocols or token sales, a common vector for credential theft in the blockchain ecosystem. Infrastructure analysis reveals concrete indicators of compromise. The domain was registered on April 29, 2026, through OwnRegistrar, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 Cloudflare, Inc. Despite its recent creation, the domain has already been added to one security blocklist, though VirusTotal currently shows 0/95 detections. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for malicious actors due to its free and automated issuance process. The lack of prior detections does not diminish the threat; rather, it highlights the domain's evasive nature and potential for rapid exploitation. Users who have visited xrparmytoken.world or interacted with its content should take immediate remedial action. Disconnect all active wallet sessions and revoke any connected dApp authorizations. Conduct a full scan of the device for malware or unauthorized extensions, particularly those targeting browser-based cryptocurrency wallets. Rotate all credentials associated with crypto accounts, including seed phrases and private keys, and monitor transaction histories for unauthorized activity. If financial loss has occurred, report the incident to relevant financial authorities and provide all available indicators of compromise, including the domain, IP address, and SSL certificate details, for further investigation.