dexpiroxp[.]com

This domain, dexpiroxp.com, is identified as a crypto wallet drainer phishing site designed to steal cryptocurrency assets from unsuspecting users. Analysis indicates the site impersonated legitimate cryptocurrency platforms, tricking visitors into connecting their wallets or entering private keys. Once accessed, the malicious infrastructure would drain funds from the victim’s wallet without authorization, a tactic commonly associated with fraudulent decentralized finance (DeFi) schemes. The site’s infrastructure and design closely mimic trusted services, increasing the likelihood of successful deception among users unfamiliar with such threats. Infrastructure analysis reveals the domain was registered on February 22, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. At the time of detection, the domain resolved to the IP address 104.21.19.66 and was flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate but elevated risk level. Additionally, the domain appeared on three security blocklists, including those maintained by browser extensions and enterprise security tools. The page title, Dexpiro, suggests an attempt to impersonate a legitimate service, further corroborating its fraudulent intent. Users who visited dexpiroxp.com or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts linked to the site and revoke any suspicious permissions granted to decentralized applications. Next, transfer remaining assets to a new, secure wallet using a trusted device. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where possible. If private keys or recovery phrases were entered on the site, consider the compromised wallet permanently at risk and avoid reusing it. Finally, report the domain to relevant security communities to aid in broader threat mitigation efforts.