# PhishDestroy domain threat record: ximcooinxs.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ximcooinxs.top/
Machine-readable companion: https://phishdestroy.io/domain/ximcooinxs.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 16:20:42 UTC
- Stored record updated: 2026-10-26 21:11:19 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 45.135.237.196
- Registrar in stored WHOIS data: NameSilo,LLC
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-09 14:30:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16a3a-f279-730b-81c1-1fe9d6b5e84f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ximcooinxs.top
- Certificate Transparency search: https://crt.sh/?q=%25.ximcooinxs.top
- Web Archive lookup: https://web.archive.org/web/*/https://ximcooinxs.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows an XM-branded trading interface with an XM 15 YEARS logo, an Important Notice modal reading Please contact customer service for more information, large Recharge and Withdrawal buttons, and a bottom menu of Home, Trade, Offer and Mine. PhishDestroy first saw ximcooinxs.top on 2026-10-26, seventeen days after its registration on 2026-10-09. PhishDestroy listed the domain after VirusTotal flagged it as malicious. The engine analysis behind that verdict was dated 2026-10-23.

How the scam works
The Recharge and Withdrawal controls frame the captured page as a funding interface, the pattern behind deposit-steering schemes, while the notice pushes visitors into direct contact with customer service. By presenting XM branding, the page borrows broker trust to encourage transfers or credential entry. PhishDestroy assesses this as a category-level deposit scam risk rather than proven fraud.

Evidence
The captured screenshot from 2026-10-26 shows the XM 15 YEARS branding, the Important Notice modal directing visitors to customer service, Recharge and Withdrawal buttons, and a Home, Trade, Offer and Mine navigation. Site inspection recorded 23 requests with no third-party scripts, Vue and Vite globals alongside TradingView and i18n objects, and 3 distinct script SHA256 hashes for campaign pivoting, the first beginning cb0c6c9f1771; no cross-site redirect was recorded. urlscan scored the domain malicious at 96 on 2026-10-23, Cloudflare Radar returned a malicious verdict on 2026-10-26 tagged dga domains and phishing, OTX recorded 3 pulses with MetaMask, SEAL and PhishDestroy internal blocklist entries checked on 2026-10-26, and the separate Google Safe Browsing check and Spamhaus lookup were negative on 2026-10-26. VirusTotal flagged the domain as malicious, with Google Safe Browsing and Lionic labelling it phishing and another vendor marking it suspicious, while urlscan's overall verdict was clean.

Infrastructure
The domain was registered through NameSilo, LLC on 2026-10-09, used Cloudflare nameservers, and the captured response carried an nginx server header from the recorded A record. The captured response lacked Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP, while HSTS was present only as max-age=31536000 without subdomain coverage. TLS 1.3 was negotiated with TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2; no SPF, DKIM or DMARC data was recorded; a CAA record was present; DNSSEC was unsigned.

What to do
Anyone who submitted credentials or personal details through this page should change their password on the genuine service, enable two-factor authentication, and contact that service only through its official channels, and should not send funds to details supplied by this page. Defenders should block ximcooinxs.top and may use the recorded script hashes to pivot on related campaigns.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16a3a-f279-730b-81c1-1fe9d6b5e84f/
Cloudflare Radar report: https://radar.cloudflare.com/scan/3d22f85e-2454-4a5e-acf4-224253335c35
Stored capture screenshot: https://urlscan.io/screenshots/01a16a3a-f279-730b-81c1-1fe9d6b5e84f.png
Cloudflare Radar screenshot (2026-10-26T16:29:50Z): https://screenshots.phishdestroy.io/cf/3d22f85e-2454-4a5e-acf4-224253335c35.png
URLScan screenshot (2026-10-23T19:10:57Z): https://screenshots.phishdestroy.io/us/01a16a2c-4368-7434-b62a-fbc51c8a1293.png
URLScan capture report: https://urlscan.io/result/01a16a2c-4368-7434-b62a-fbc51c8a1293/
VirusTotal report: https://www.virustotal.com/gui/domain/ximcooinxs.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ximcooinxs.top
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:40:38 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16a3a-f279-730b-81c1-1fe9d6b5e84f.png
  Captured: 2026-10-26 16:20:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16a3a-f279-730b-81c1-1fe9d6b5e84f.png
  Source report: https://urlscan.io/result/01a16a3a-f279-730b-81c1-1fe9d6b5e84f/
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a2c-4368-7434-b62a-fbc51c8a1293.png
  Captured: 2026-10-23 19:10:57 UTC
  Source report: https://urlscan.io/result/01a16a2c-4368-7434-b62a-fbc51c8a1293/
  SHA-256: 7e7e1f070ae952fec81636bc25431f64660e34872be3737a9786c9b4d346b8f7
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3d22f85e-2454-4a5e-acf4-224253335c35.png
  Captured: 2026-10-26 16:29:50 UTC
  Source report: https://radar.cloudflare.com/scan/3d22f85e-2454-4a5e-acf4-224253335c35
  SHA-256: f5f293ec4e8b42de9a9b35bab8c70f1d0056bbb02a0459d9039c2b9cc2f25216

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:32:54Z",
        "uuid": "01a16a3a-f279-730b-81c1-1fe9d6b5e84f",
        "scanned_at": "2026-10-23T19:27:22Z",
        "final_url": "https://ximcooinxs.top/",
        "status": 200,
        "ip": "45.135.237.196",
        "ips": [
            "45.135.237.196"
        ],
        "asns": [
            "153656"
        ],
        "countries": [
            "HK"
        ],
        "doc_hash": "24caad449adb62bf2cbd4f0e214884c53257d647a80d584ec5d0141c2544789d",
        "script_hashes": [
            "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151",
            "d575fd413bb756b190d0e7f00f65aed26a2540757c55a0d1bda254b455d05aee",
            "17ed9a4e31902d325cb1dcdfe59e5de31b0d44a0e909857196b5e571c9ec8145"
        ],
        "globals": [
            "addLink",
            "addMeta",
            "TradingView",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser",
            "__VUE_I18N_INSTANCE__"
        ],
        "storage_keys": [
            "undefined_THEME"
        ],
        "tls": {
            "san": [
                "ximcoiin.com",
                "ximcoiins.top",
                "ximcooinxs.top"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "ximcoiin.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-07T15:49:14Z",
            "valid_from": "2026-10-09T15:49:15Z"
        },
        "domain_age_days": 13,
        "apex_age_days": 13,
        "tls_age_days": 14,
        "tls_valid_days": 89,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:14Z",
        "uuid": "3d22f85e-2454-4a5e-acf4-224253335c35",
        "scanned_at": "2026-10-26T16:29:50Z",
        "final_url": "https://ximcooinxs.top/",
        "status": 200,
        "history": [
            {
                "url": "https://ximcooinxs.top/",
                "status": 200
            }
        ],
        "dom_hash": "4a16e7ef24491b9102eab879e8d18f527d2bb64a41db288f7e0a9adf3aa2d5f6",
        "doc_hash": "24caad449adb62bf2cbd4f0e214884c53257d647a80d584ec5d0141c2544789d",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "DGA Domains",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ximcooinxs.top",
                "type": "A",
                "value": "45.135.237.196"
            }
        ],
        "dnssec_valid": false,
        "ip": "45.135.237.196",
        "verdict": {
            "tags": [
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "dga domains"
            ]
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "created": "2026-10-09T16:30:09Z",
            "updated": "2026-10-09T16:30:11Z",
            "expires": "2027-10-09T16:30:09Z",
            "nameservers": [
                "becky.ns.cloudflare.com.",
                "conrad.ns.cloudflare.com."
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T19:01:37Z",
        "analysis_at": "2026-10-23T19:14:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "Lionic": "phishing",
            "alphaMountain.ai": "suspicious",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "registrar": "NameSilo,LLC",
        "created": "2026-10-09T16:30:09Z",
        "expires": "2027-10-09T16:30:09Z",
        "updated": "2026-10-09T16:30:11Z",
        "first_seen": "2026-10-09T17:35:46Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "becky.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "conrad.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "45.135.237.196"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "becky.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T19:19:54Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "ximcoiin.com",
                "ximcoiins.top",
                "ximcooinxs.top"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "539d2daf7c536314c17103b9f7f87a614e6",
            "sha256": "9b0ce729c3e638d404cafabc9b88f5d92856889f4113dccd6c2d4941eb0a0aa8",
            "subject": "ximcoiin.com",
            "valid_to": "2027-01-07T15:49:14Z",
            "valid_from": "2026-10-09T15:49:15Z"
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "https://www.namesilo.com",
            "created": "2026-10-09T16:30:09Z",
            "updated": "2026-10-09T16:30:11Z",
            "expires": "2027-10-09T16:30:09Z",
            "status": [
                "addPeriod",
                "ok"
            ],
            "nameservers": [
                "becky.ns.cloudflare.com",
                "conrad.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-10-09T16:30:09Z",
                "last changed": "2026-10-09T16:30:11Z",
                "registration": "2026-10-09T16:30:09Z",
                "last update of RDAP database": "2026-10-23T19:17:03Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:34:27Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "ximcooinxs.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:32:22Z",
            "first": "2026-10-11T03:27:08Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0.06,
            "avg_page_bytes": 2697
        },
        "social_tags": {
            "title": "undefined",
            "robots": "all",
            "ogImage": "/platform/dev/logo_144.png?2.0.1791382435617",
            "ogTitle": "undefined",
            "keywords": "undefined",
            "themeColor": "#ffffff",
            "description": "undefined",
            "ogDescription": "undefined"
        },
        "trackers": {
            "requests": 23
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 196,
                "wait": 195,
                "connect": 191,
                "download": 0
            },
            "response_ms": 586
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 5278,
            "co2_grams": 0.0002,
            "cleaner_than": 86
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.146",
                    "host": "conrad.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.73",
                    "host": "becky.ns.cloudflare.com"
                }
            ],
            "zone": "ximcooinxs.top"
        },
        "location": {
            "ip": "45.135.237.196",
            "asn": "153656",
            "org": "OWGELS INTERNATIONAL CO., LIMITED",
            "city": "Kwun Tong",
            "country": "HK"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "ximcoiin.com"
        },
        "dns": {
            "A": [
                "45.135.237.196"
            ],
            "NS": [
                "conrad.ns.cloudflare.com",
                "becky.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"becky.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418290249, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "google-site-verification=PAIBfJEIvRHen_54cjvGuQ42pi9x5X3b1ohNFzY9qnw"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "45.135.237.196",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://ximcooinxs.top"
            ]
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "created": "2026-10-09T16:30:09Z",
            "updated": "2026-10-09T16:30:11Z",
            "expires": "2027-10-09T16:30:09Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "becky.ns.cloudflare.com",
                "conrad.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```