xpresale[.]org

The domain xpresale.org, which impersonates MetaMask, has been taken offline but remains a significant example of phishing activity. With 6 out of 95 vendors on VirusTotal flagging it as malicious, the domain has also been listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This indicates a well-documented threat despite its current offline status.

Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain was hosted on an IP address managed by Cloudflare, Inc. in Canada. The SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its free and automated service. The domain was created on April 8, 2026, and was detected by PhishDestroy on April 20, 2026, highlighting the rapid deployment typical of phishing campaigns.

The site, titled "X Token," aimed to deceive users by mimicking MetaMask, a popular cryptocurrency wallet. This tactic is part of a broader trend where attackers exploit the trust associated with well-known brands to harvest sensitive information. Although the site is now offline, the incident underscores the importance of early detection in mitigating phishing threats. PhishDestroy's ability to identify such domains shortly after their creation is crucial in the fight against cybercrime, as it helps bridge the gap before traditional antivirus solutions can update their databases.