xn--xpmrket-7wa[.]com

The domain xn--xpmrket-7wa.com was registered on February 27 2026 through Tucows Domains Inc. and is presently taken offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The authoritative nameservers are arely.ns.cloudflare.com and luke.ns.cloudflare.com, indicating that the infrastructure is hosted on Cloudflare’s edge network. No SSL/TLS certificate is presented for the site, meaning any HTTPS connection would be rejected or fall back to HTTP, a characteristic often observed in hastily deployed phishing or crypto‑drain campaigns.

The page title retrieved from the site reads "ΧΡΜarket: Yοur Web3 Gateway tο ΧRΡL - DΕΧ, ΝFΤs, Τοkens," explicitly positioning the site as a cryptocurrency gateway and suggesting a focus on decentralized exchange (DEX) and NFT services. VirusTotal reports four of ninety‑three security vendors flagging the domain, and the domain appears on one external blocklist, demonstrating limited but notable detection across the security community. PhishDestroy has actively blocked the domain, reinforcing its classification as a crypto‑related scam. While the exact phishing kit or victim‑targeting tactics have not been disclosed, the available evidence aligns with a generic crypto‑drainer profile.

Defenders should add the domain and its associated IP address to perimeter blocklists, monitor for any residual DNS queries, and include the Cloudflare nameservers in threat‑intel feeds to capture potential reuse. Continuous monitoring of the IP range 188.114.97.0/24 for similar activity is advised, as adversaries often recycle the same hosting assets. Because the site is offline, any active payloads are likely dormant, but threat actors may repurpose the same infrastructure for future campaigns, so vigilance remains warranted.