xxcp.com: Confirmed Credential Harvesting Phishing Endpoint

Analysis of the domain xxcp.com indicates active credential harvesting infrastructure with high-risk characteristics. Registered on May 20, 2026, through a major registrar, the domain currently resolves to 104.255.229.120, hosted by a US-based provider. The absence of an SSL certificate is atypical for legitimate authentication portals, while the HTTP 200 status suggests the site remains operational and responsive to visitor requests. Infrastructure review reveals Cloudflare nameservers (carol.ns.cloudflare.com and lex.ns.cloudflare.com), a common pattern among phishing operators seeking to obscure hosting origins. The domain appears on one security blocklist and is flagged by two of ninety-five vendors in a multi-engine scan, providing minimal but consistent detection coverage. A single threat intelligence pulse further corroborates malicious classification, though specific campaign attribution remains unverified. Defenders should prioritize blocking both the domain and its resolved IP address at network perimeter controls. The eight-week registration age and continued activity indicate the endpoint may persist for additional weeks unless disrupted. While no brand impersonation is confirmed, the combination of missing encryption, Cloudflare proxying, and sparse but unanimous detection signals a dedicated phishing resource rather than opportunistic compromise. Monitoring for new subdomains or IP shifts is recommended given the domain's recent creation and current operational status.