xapobank[.]live

The domain xapobank.live was observed on a single security blocklist and is actively listed as blocked by the PhishDestroy feed. VirusTotal records indicate that the hostname was submitted to the service and examined by 91 antivirus and URL‑reputation engines; none of the engines returned a positive detection at the time of analysis. The absence of a detection does not imply that the site is benign, nor does it confirm malicious intent, but the presence on a blocklist and the specific inclusion in PhishDestroy’s phishing feed suggest that the domain is being used for credential‑harvesting campaigns targeting banking customers. No additional intelligence such as registrar information, IP address, autonomous system number, hosting provider, SSL certificate details, HTTP response codes, Safe‑Browsing verdicts, or page‑title metadata has been published in the current dataset.

Consequently, the infrastructure behind xapobank.live cannot be profiled beyond the blocklist attribution. The threat‑type field classifies the activity as banking phishing, and the operational status is marked as active with a risk level of “under investigation,” indicating that the campaign may still be in its early stages or that evidence is still being gathered. Defenders should treat xapobank.live as a high‑confidence indicator of compromise for banking credential theft.

Recommended mitigations include adding the domain to corporate web‑filter deny lists, configuring email gateways to block URLs matching the hostname, and monitoring network traffic for DNS queries or HTTP requests to the domain. Continuous re‑evaluation is advised, as future scans by additional reputation services or updates to blocklists may provide further context. Organizations should also educate end‑users about unsolicited messages that reference banking services and encourage the use of multi‑factor authentication to reduce the impact of any potential credential exposure.