xport[.]al

Analysis of the domain xport.al shows an active high‑risk crypto‑drainer operation. The site returns an HTTP 307 redirect and presents the page title "xPortal - The Crypto Super App," indicating a likely attempt to lure cryptocurrency users. Infrastructure data links the domain to a single AWS EC2 instance in the us‑west‑2 region (IP 35.167.216.18) and the server uses a Let's Encrypt certificate (YR2). Technical fingerprints reveal the use of Sendgrid for email delivery, jsDelivr for static assets, Google Tag Manager and Google Analytics for tracking, Cloudflare for CDN and HTTP/3 support, and Branch for deep‑linking. The domain was registered on June 08, 2026 and has a Gridinsoft trust score of 0/100, reflecting a lack of reputable reputation. Threat intelligence sources record the domain in four AlienVault OTX pulses and three public blocklists; it is also blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show five of ninety‑one security engines flagging the domain, reinforcing the malicious assessment. While the exact content of the landing page has not been examined, the combination of a crypto‑focused title, redirection behavior, and supporting infrastructure strongly suggests a credential‑stealing or wallet‑draining campaign. Defenders should block the domain at DNS and web‑filter layers, monitor outbound connections to the associated IP, and flag any emails originating from the Sendgrid service tied to this host. Continuous observation of the IP and any newly observed subdomains is recommended, as the operator may shift infrastructure to evade detection.