0xf2[.]top

The domain 0xf2.top was a phishing site engaged in brand impersonation targeting Discord users. It posed as a legitimate Discord-related promotion, specifically advertising a fraudulent 'DYDX Airdrop' to deceive victims into disclosing login credentials or other sensitive information. No crypto drainer kit was identified, but the site operated as a social media scam under the guise of a cryptocurrency airdrop. As of the latest verification, 0xf2.top has been taken offline.

Technical indicators confirm the malicious nature of 0xf2.top. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0/100. It appeared on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through NiceNIC International Group Co., Limited, the domain was created on February 21, 2026, and resolved to the IP address 172.67.128.58, hosted by Cloudflare in the US (AS13335). No SSL certificate was available, and the observed page title was 'DYDX Airdrop - Join the DEX Today!'. Nameservers were celeste.ns.cloudflare.com and owen.ns.cloudflare.com.

Victims of 0xf2.top should immediately change any passwords or credentials entered on the site, particularly for Discord or associated accounts. Enable two-factor authentication (2FA) to add an extra layer of security. Monitor accounts for unauthorized activity and report any suspected fraud to the relevant platform. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the impersonated brand’s abuse team. If financial or cryptocurrency transactions were involved, contact the wallet provider or exchange for further assistance.