0xp29[.]top

The domain 0xp29.top is identified as a cryptocurrency phishing site designed to harvest wallet credentials or deploy crypto drainer scripts. Analysis confirms the domain is currently offline, though prior activity suggests it operated as an active threat targeting cryptocurrency users. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential theft and wallet-draining campaigns. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.60.190 and is flagged by 3 of 95 security vendors on VirusTotal. The domain appears on four security blocklists and holds a Gridinsoft trust score of 0/100. Detected technologies include HSTS, Cloudflare, and HTTP/3, with an SSL certificate issued by Google Trust Services. The page title, '522: Connection timed out,' suggests recent disruption or takedown efforts. The domain is currently offline, but residual risk remains due to its recent registration and prior malicious classification. Organizations and individuals are advised to block the domain and associated IP at the network level. Users who interacted with the domain should revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and rotate credentials for cryptocurrency platforms. Security teams should treat this domain as a confirmed phishing resource and include it in threat intelligence feeds for proactive defense.