xp2p[.]top

PhishDestroy identifies xp2p.top as an active crypto drainer phishing domain posing as a fake cryptocurrency service. The site leverages deceptive tactics to trick users into connecting wallets and signing malicious transactions, resulting in fund theft. This threat specifically targets cryptocurrency users with sophisticated social engineering and UI spoofing to mimic legitimate platforms, increasing the risk of irreversible asset loss upon interaction. This domain was flagged by multiple security systems including SEAL and MetaMask, with a VirusTotal detection rate of 2 out of 95 security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 24, 2026, and resolves to IP address 104.21.16.175. It appears on two known blocklists and carries a Let's Encrypt SSL certificate, which may be used to establish false trust with visitors. Despite these red flags, the domain remains active and continues to operate without takedown intervention. As of the latest assessment, xp2p.top maintains an elevated risk level with no confirmed remediation. Users should avoid accessing this domain entirely, and cryptocurrency wallet users must exercise extreme caution with unsolicited links and browser extensions. The absence of comprehensive blocking across major platforms suggests persistent threat exposure. Until coordinated action is taken, the remaining risk remains high for individuals who may encounter this domain through phishing campaigns or malvertising.