mcrph[.]top

The domain mcrph.top is an active phishing site engaged in brand impersonation targeting x.com. It presents itself as a legitimate login portal for the social media platform but is designed to harvest user credentials. No crypto drainer kit has been identified on this domain, and it remains operational as of analysis. Users searching whether mcrph.top is safe or a scam should treat it as a confirmed phishing threat.

Technical indicators confirm mcrph.top as a malicious domain. It is flagged by 3 of 95 VirusTotal security vendors, including Fortinet, Gridinsoft, and SOCRadar. The domain was registered on 2025-12-01 13:43:49 through NiceNIC International Group Co., Limited and resolves to IP address 172.67.137.229, hosted on Cloudflare infrastructure in the US (AS13335). It appears on 1 security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title is 'Welcome to nginx!' with an HTTP 403 status, suggesting restricted access or a placeholder page.

Victims of mcrph.top should immediately change passwords for any accounts accessed via the site, enable two-factor authentication, and monitor for unauthorized activity. Report the domain to x.com’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. If financial or crypto accounts were exposed, revoke token approvals and consider transferring funds to a new wallet. Avoid interacting with mcrph.top or any linked resources.