xpm4[.]top

Analysis of the domain xpm4.top reveals infrastructure consistent with a crypto-based phishing operation targeting users through a fraudulent USDC token airdrop scheme. The domain was registered on March 3, 2026, via NiceNIC International Group Co., Limited, and is currently offline as of July 24, 2026. It resolves to IP address 172.67.143.240, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin and evade takedowns. The domain uses Cloudflare nameservers (alan.ns.cloudflare.com and veda.ns.cloudflare.com), further leveraging the provider's infrastructure for resilience.

The page title, '$USDC Token Airdrop,' explicitly indicates the scam's focus on impersonating a legitimate cryptocurrency giveaway, a known vector for credential theft and wallet drainage. While the exact phishing kit is classified as an 'Airdrop Scam,' no SSL certificate was detected, which is atypical for modern phishing sites but may reflect rapid deployment or cost-cutting measures. Detection by security vendors remains limited, with only 2 of 94 engines on VirusTotal flagging the domain at the time of assessment. However, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior identification by specialized anti-fraud systems.

Defenders should note that the domain's infrastructure, while currently offline, may resurface under altered configurations or new domains. The use of Cloudflare hosting and the absence of SSL do not inherently confirm malicious intent but align with patterns observed in low-effort phishing campaigns. Organizations are advised to block the domain and its associated IP (172.67.143.240) at the network level, monitor for related domains registered through the same registrar, and alert users to the risks of cryptocurrency airdrop scams. Further investigation into the registrar's history may reveal additional linked domains, though no direct evidence of broader abuse is present in the current data.