xpd[.]lol

This domain, xpd.lol, is a confirmed phishing site designed to steal cryptocurrency wallet credentials and private keys. Analysis indicates it presents itself as a legitimate wallet interface or token distribution platform, tricking users into entering sensitive information. The site employs social engineering tactics, such as fake airdrop claims or urgent security alerts, to pressure visitors into disclosing their recovery phrases or passwords. Once obtained, attackers use this information to drain funds from connected wallets, often within minutes of compromise. The threat primarily targets users of decentralized finance platforms and popular wallet applications. Infrastructure analysis reveals multiple red flags confirming its malicious nature. The domain was registered on March 09, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with newly created phishing domains. As of the latest scan, 12 out of 95 security vendors on VirusTotal flagged xpd.lol as malicious, with detections including credential phishing and cryptocurrency theft. The site resolves to the IP address 188.114.96.3 and is hosted behind Cloudflare, which is commonly used to mask the true origin of phishing infrastructure. Additionally, the domain appears on four independent security blocklists, including those maintained by cryptocurrency security teams, further validating its classification as a high-risk threat. If you visited xpd.lol or interacted with its content, immediate action is required to mitigate potential damage. First, disconnect any devices used to access the site from the internet to prevent ongoing data exfiltration. If you entered wallet credentials or recovery phrases, assume your funds are compromised and transfer remaining assets to a new, secure wallet using a different device. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities. Do not reuse passwords or recovery phrases from the compromised wallet, as attackers may attempt to access other accounts using the same credentials.