xp-aff[.]com

PhishDestroy identifies xp-aff.com as a credential theft domain leveraging a crypto drainer-style attack vector, flagged for brand impersonation targeting cryptocurrency users. The domain was registered on June 29, 2023, via PDR Ltd. d/b/a PublicDomainRegistry.com, resolving to IP 83.147.206.148 and secured with a Let’s Encrypt SSL certificate. No drainer kit artifacts or specific brand impersonation targets have been extracted from available telemetry at this stage. This domain exhibited 0 detections out of 95 scans on VirusTotal as of its takedown, indicating it had evaded initial detection despite clear malicious intent. The registrar, IP infrastructure, and domain age profile align with opportunistic threat actor behaviors, though its recent creation and rapid takedown suggest a possibly short-lived campaign. Review of Google Safe Browsing status indicates no blocklisting at identification, leaving users vulnerable during its active window. The domain is currently offline, with the threat level under investigation pending further forensic analysis. Stakeholders are advised to block xp-aff.com via DNS and firewall rules, scan internal endpoints for related activity, and report indicators to threat intelligence platforms. While immediate risk is mitigated, residual exposure may persist via cached content or mirror domains leveraging the same infrastructure. Monitor closely for re-registration or campaign relocation.