# PhishDestroy domain threat record: x-pay.qpon Content language: English Canonical HTML report: https://phishdestroy.io/domain/x-pay.qpon/ Machine-readable companion: https://phishdestroy.io/domain/x-pay.qpon/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:19:51 UTC - Last availability or vendor check: 2026-10-28 11:03:52 UTC - Stored record updated: 2026-10-28 11:26:25 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.151.60 - Registrar in stored WHOIS data: GLOBAL ASSET DOMAINS INC - Registrar country in stored WHOIS data: SG - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-19 23:31:51 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1791e-f672-749e-8c32-74e860ac0ba1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/x-pay.qpon - Certificate Transparency search: https://crt.sh/?q=%25.x-pay.qpon - Web Archive lookup: https://web.archive.org/web/*/https://x-pay.qpon/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added x-pay.qpon to its internal blocklist after an admin report highlighted its very recent registration and the absence of meaningful page content. The prior automated assessment marked the site as unknown because the page provided insufficient content for analysis. The recorded page returned HTTP 200 and the title shown was “Xpay”. The domain was first seen by PhishDestroy on 2026-10-26. How the scam works No specific malicious behavior was observed on this site, so the listing does not confirm a particular scam type. In general, newly registered domains with minimal visible content can be used for phishing, credential harvesting, or fraudulent financial offers, but such mechanisms were not demonstrated here. Evidence VirusTotal scanned the domain on 2026-10-24 with 92 engines and reported 0 malicious or suspicious detections. Google Safe Browsing checked on 2026-10-26 and did not flag the site. urlscan.io captured the page on 2026-10-23, gave an overall clean verdict, but its machine‑learning engine assigned a malicious score of 99 while the overall malicious flag remained false. OTX listed 0 pulses as of 2026-10-26. No external blocklists reported the domain, and PhishDestroy’s internal list marks it as suspicious. Infrastructure The domain was registered on 2026-10-20 through GLOBAL ASSET DOMAINS INC. A Let’s Encrypt certificate covering *.x-pay.qpon and x-pay.qpon was issued the same day and is valid until 2027-01-18. Cloudflare provides DNS and CDN services; recorded A records are 172.67.151.60 and 104.21.48.123, and AAAA records include 2606:4700:3036::ac43:973c. DNSSEC is not enabled. The domain age is 2 days and the TLS certificate age is 3 days. What to do Treat the site as potentially unsafe; avoid entering credentials, payment details, or personal information. If any credentials were submitted, change them immediately and monitor associated accounts for unusual activity. Security teams should block traffic to x-pay.qpon, log any access attempts, and review internal logs for signs of credential use. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a167d0-fc16-72b8-85a6-09b1b3a04f20/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e6a071c0-923f-4629-bd5f-8c9c21fcc678 Stored capture screenshot: https://urlscan.io/screenshots/01a167d0-fc16-72b8-85a6-09b1b3a04f20.png Cloudflare Radar screenshot (2026-10-26T16:30:19Z): https://screenshots.phishdestroy.io/cf/e6a071c0-923f-4629-bd5f-8c9c21fcc678.png URLScan screenshot (2026-10-23T07:50:38Z): https://screenshots.phishdestroy.io/us/01a167bd-59c2-764d-99d6-522ecb92e524.png URLScan capture report: https://urlscan.io/result/01a167bd-59c2-764d-99d6-522ecb92e524/ VirusTotal report: https://www.virustotal.com/gui/domain/x-pay.qpon Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=x-pay.qpon Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 16:37:14 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Xk2fnPM9/f7d0f211eb5a.png Captured: 2026-10-26 16:51:49 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a1791e-f672-749e-8c32-74e860ac0ba1.png Captured: 2026-10-26 16:51:49 UTC Source report: https://urlscan.io/result/01a1791e-f672-749e-8c32-74e860ac0ba1/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a167d0-fc16-72b8-85a6-09b1b3a04f20.png Captured: 2026-10-26 16:19:51 UTC Source report: https://urlscan.io/result/01a1791e-f672-749e-8c32-74e860ac0ba1/ - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167bd-59c2-764d-99d6-522ecb92e524.png Captured: 2026-10-23 07:50:38 UTC Source report: https://urlscan.io/result/01a167bd-59c2-764d-99d6-522ecb92e524/ SHA-256: 766bdad66b9ddbf6fc3bf779a992401994dc243f67b5272d18d3b8ad3a47e207 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17913-6b6b-735a-9902-d95d58913dc0.png Captured: 2026-10-26 16:38:11 UTC Source report: https://urlscan.io/result/01a17913-6b6b-735a-9902-d95d58913dc0/ SHA-256: adf9ac280951f523da57c29fc43a94a747ef5d0a8c685cf4bc0e9ac12ccb05d3 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17919-dcd5-74c7-bdf0-08c899aac761.png Captured: 2026-10-26 16:45:11 UTC Source report: https://urlscan.io/result/01a17919-dcd5-74c7-bdf0-08c899aac761/ SHA-256: 1ad93601d46562a6db4a06a449ddfcabc83b915fedf2bd9afdf1fe2c6c900044 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1791e-f0d6-7349-8d8c-755ec4e25e0a.png Captured: 2026-10-26 16:50:43 UTC Source report: https://urlscan.io/result/01a1791e-f0d6-7349-8d8c-755ec4e25e0a/ SHA-256: db243c605b2397ee151c3f8d7680debedc85f43ef8fecd99b7a0e756a3af152d - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e6a071c0-923f-4629-bd5f-8c9c21fcc678.png Captured: 2026-10-26 16:30:19 UTC Source report: https://radar.cloudflare.com/scan/e6a071c0-923f-4629-bd5f-8c9c21fcc678 SHA-256: dd8d1433a135beeaff4e3d179d06481d56098270465d310631d6293cca03d413 - URLQuery: https://screenshots.phishdestroy.io/uq/f4b2550b-522e-4c8d-9d3c-ba69572cd2b4.png Source report: https://urlquery.net/report/f4b2550b-522e-4c8d-9d3c-ba69572cd2b4 SHA-256: cf10a2550cff77b889db1d92f76c8201fd3b762e36c801f508206207f14f2e26 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167d0-fc16-72b8-85a6-09b1b3a04f20.png Captured: 2026-10-23 08:12:10 UTC Source report: https://urlscan.io/result/01a167d0-fc16-72b8-85a6-09b1b3a04f20/ SHA-256: baa9f83bd4135bad237e76f1dfe3fe77685e413e5ab89d23d0f8536497efa8ad ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T18:11:41Z", "uuid": "01a1791e-f672-749e-8c32-74e860ac0ba1", "scanned_at": "2026-10-26T16:50:49Z", "final_url": "https://x-pay.qpon/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://x-pay.qpon/", "from": "http://x-pay.qpon/", "status": 307 } ], "ip": "172.67.151.60", "domains": [ "api.x-pay.qpon", "plugin-code.salesmartly.com", "bin.bnbstatic.com", "msg.salesmartly.com", "srz.salesmartly.com", "newbasset.s3.ap-east-1.amazonaws.com", "widget.salesmartly.com", "client.salesmartly.com", "api.salesmartly.com", "mix-ads.oss-accelerate.aliyuncs.com" ], "ips": [ "104.18.23.242", "47.254.187.140", "104.18.22.242", "2600:9000:2490:5200:17:cdfa:4740:93a1", "3.5.214.245", "18.245.46.112", "2600:9000:266e:7a00:1b:20a4:b040:93a1", "172.67.151.60" ], "asns": [ "13335", "45102", "16509" ], "countries": [ "DE", "US", "HK" ], "link_domains": [ "www.tradingview.com" ], "doc_hash": "ef121215dbc73622a813f4544b9291067c679a7e2b4c4b6da4b6cb44f612c404", "script_hashes": [ "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151", "62414303dc3caba3e1b6c53714fe79a1ea719d2785441992e54bd9ef8b163e86", "5e545c3087378bfa53bbeadbf9178acb2d011d8f1e303c855eba0769c570ad54", "de24d01af18e56461133a28c1f19bcd3c242ea7296ff07b722ad6d6fb5dea7bb", "2ad3e0af83059e4173a388928d315482fdf9556bdf0b20d81f6f3cf67eb7067a", "29de6181f13154b62743ed52e7a928db4ff877d52e5cf41373d8f4e815ed457b", "8685dd592194f86822a10bc2cd8d6f397d9eadd116d1630739f1f908a29cf02b", "96d2749a39b4d6abf12f0448e67a30ad897c62c0ee79455cb8016ef3ed7ef271" ], "globals": [ "TradingView", "__ACChat", "addMeta", "lib", "rem", "dpr", "__VUE_INSTANCE_SETTERS__", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "PubSub", "setImmediate", "clearImmediate", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "__config", "__theme", "apiready", "__VUE__", "__ssc", "ssq", "install_ss_chat_plugin", "ss_chat_plugin_version", "__read", "__spreadArray", "__SS_CHAT_RUNTIME__", "__SS_CHAT_SCRIPT_MODE__", "SHOPINFO", "ASSETS_HOSTNAME_VARIABLE", "ASSETS_CDN_HOSTNAME_VARIABLE", "STATIC_HOSTNAME_VARIABLE", "__SS_CHAT_SHADOWROOT__", "ssmEvent", "__VUE_SSR_SETTERS__", "saveAs", "marked" ], "cookies": [ "ss_uid", "_ss_s_uid" ], "storage_keys": [ "DERIVA_THEME", "main", "DERIVA_LANGUAGE", "salesmartly_p_g1kwgl3_session_tab_key", "salesmartly_p_g1kwgl3_u_i", "salesmartly_p_g1kwgl3_custom_fields_local_map", "salesmartly_p_g1kwgl3_p_xma_", "salesmartly_p_g1kwgl3_g_uid", "salesmartly_p_g1kwgl3_token_date", "salesmartly_p_g1kwgl3_token", "ss_p_c_l_v_pro", "salesmartly_p_g1kwgl3_n_u" ], "tls": { "san": [ "*.x-pay.qpon", "x-pay.qpon" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "x-pay.qpon", "protocol": "QUIC", "valid_to": "2027-01-18T00:40:13Z", "valid_from": "2026-10-20T00:40:14Z" }, "domain_age_days": 5, "apex_age_days": 5, "tls_age_days": 6, "tls_valid_days": 89, "requests": 106, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:15Z", "uuid": "e6a071c0-923f-4629-bd5f-8c9c21fcc678", "scanned_at": "2026-10-26T16:30:19Z", "final_url": "https://x-pay.qpon/", "status": 200, "history": [ { "url": "https://x-pay.qpon/", "status": 200 } ], "dom_hash": "937d7943ac65e0a0d5ab870356250d918c959a4f9260456b4a6e42035cc12c3d", "doc_hash": "bed1a09b5fd504f1c7844e70d47ffc6443b6cf104a006dabb20b4593b63e87f7", "domain_risks": [ "New Domains", "Security Risks", "Newly Seen Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "api.x-pay.qpon", "type": "A", "value": "172.67.151.60" }, { "name": "api.x-pay.qpon", "type": "A", "value": "104.21.48.123" }, { "name": "api.x-pay.qpon", "type": "AAAA", "value": "2606:4700:3030::6815:307b" }, { "name": "api.x-pay.qpon", "type": "AAAA", "value": "2606:4700:3036::ac43:973c" }, { "name": "x-pay.qpon", "type": "A", "value": "104.21.48.123" }, { "name": "x-pay.qpon", "type": "A", "value": "172.67.151.60" }, { "name": "x-pay.qpon", "type": "AAAA", "value": "2606:4700:3036::ac43:973c" }, { "name": "x-pay.qpon", "type": "AAAA", "value": "2606:4700:3030::6815:307b" } ], "dnssec_valid": false, "ip": "104.21.48.123", "whois": { "registrar": "GLOBAL ASSET DOMAINS INC.", "created": "2026-10-20T01:31:51Z", "updated": "2026-10-20T01:31:56Z", "expires": "2027-10-20T23:59:59Z", "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T16:28:05Z", "analysis_at": "2026-10-24T19:00:05Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "GLOBAL ASSET DOMAINS INC", "created": "2026-10-20T01:31:51Z", "expires": "2027-10-20T23:59:59Z", "updated": "2026-10-20T01:35:18Z", "first_seen": "2026-10-20T02:21:11Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "amy.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "cleo.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:973c" }, { "ttl": 300, "type": "A", "value": "172.67.151.60" }, { "ttl": 21600, "type": "NS", "value": "amy.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:307b" }, { "ttl": 300, "type": "A", "value": "104.21.48.123" } ], "dns_at": "2026-10-24T19:13:21Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.x-pay.qpon", "x-pay.qpon" ], "issuer": "Let's Encrypt / YE2", "serial": "6280cc89a7d10d820d1aa6b0bd8cc2a9f54", "sha256": "9ed8ba973a5fd03a7bfeff7c855739c0ab0fea702b2446e62884a1c73e4197ec", "subject": "x-pay.qpon", "valid_to": "2027-01-18T00:40:13Z", "valid_from": "2026-10-20T00:40:14Z" }, "whois": { "registrar": "GLOBAL ASSET DOMAINS INC", "registrar_iana_id": "4313", "registrar_url": "http://www.gadomains.com", "created": "2026-10-20T01:31:51Z", "updated": "2026-10-20T01:31:56Z", "expires": "2027-10-20T23:59:59Z", "status": [ "addPeriod", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:36:32Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "x-pay.qpon" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:30:59Z", "first": "2026-10-26T16:30:59Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2705 }, "social_tags": { "title": "Xpay", "ogImage": "/platform/deriva/logo_144.png?2.0.1793017321335", "ogTitle": "Xpay", "keywords": "Xpay", "themeColor": "#ffffff", "description": "Xpay", "ogDescription": "Xpay" }, "trackers": { "requests": 77, "trackers": [ { "name": "Amazon Web Services", "company": "Amazon", "country": "US", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 21, "wait": 454, "connect": 7, "download": 0 }, "response_ms": 484 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 4115, "co2_grams": 0.0002, "cleaner_than": 91 }, "dns_server": { "ns": [ { "ip": "172.64.32.101", "host": "amy.ns.cloudflare.com" }, { "ip": "173.245.59.89", "host": "cleo.ns.cloudflare.com" } ], "zone": "x-pay.qpon" }, "location": { "ip": "2606:4700:3030::6815:307b", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "x-pay.qpon" }, "dns": { "A": [ "172.67.151.60", "104.21.48.123" ], "NS": [ "cleo.ns.cloudflare.com", "amy.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"amy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417971517, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::6815:307b", "2606:4700:3036::ac43:973c" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3036::ac43:973c", "family": 6 }, "redirects": { "chain": [ "https://x-pay.qpon" ] }, "whois": { "registrar": "GLOBAL ASSET DOMAINS INC.", "created": "2026-10-20T01:31:51Z", "updated": "2026-10-25T01:35:11Z", "expires": "2027-10-20T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "amy.ns.cloudflare.com", "cleo.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```