xpmarketeligibility[.]info

PhishDestroy identifies the domain xpmarketeligibility.info as an active crypto drainer threat currently leveraging brand impersonation tactics to deceive victims. This domain has been assessed with an elevated risk level and is currently in active status, indicating ongoing malicious operations. The threat actor behind this infrastructure is actively deploying strategies to compromise cryptocurrency wallets and steal digital assets from unsuspecting users.

This domain was flagged by 4 of 95 VirusTotal security vendors and is blocked by ScamSniffer. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 172.67.214.17, and holds a Let's Encrypt SSL certificate. The domain was created on April 08, 2026, and appears on 1 security blocklist. Trust scores for this domain remain critically low, reflecting its malicious intent and high-risk nature.

Current status indicates active distribution and deployment of this crypto drainer. Users are strongly advised to avoid interacting with this domain or any associated URLs. Security teams should implement network-level and endpoint-level blocking for this domain and IP address. Immediate reporting to threat intelligence platforms and local CERT teams is recommended to enhance collective defense. Maintaining updated threat feeds and leveraging real-time monitoring tools will help prevent further exposure to this evolving crypto drainer campaign.