0xpv1[.]top

This domain, 0xpv1.top, is actively engaged in credential harvesting targeting cryptocurrency wallet users. Analysis indicates the site mimics legitimate wallet interfaces to deceive victims into entering private keys or recovery phrases, enabling unauthorized access to digital assets. The page title '522: Connection timed out' suggests either a temporary hosting issue or deliberate obfuscation to evade automated detection systems. Infrastructure analysis reveals the domain was registered on May 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to IP address 172.67.175.160, hosted on Cloudflare infrastructure in Canada, which is commonly exploited to mask true server locations. The domain appears on 3 security blocklists and is flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The SSL certificate is issued by Let's Encrypt, providing a false sense of legitimacy. Users who have visited 0xpv1.top or entered credentials on the site should immediately revoke access to any associated cryptocurrency wallets. Rotate all passwords, recovery phrases, and private keys linked to the compromised session. Monitor wallet transactions for unauthorized activity and report any suspicious transfers to relevant blockchain explorers or security teams. If the site was accessed via a corporate or managed device, initiate an incident response protocol to contain potential lateral movement.