# xpm8.top — SUSPICIOUS

> Explore the potential phishing risks of xpm8.top. Under active review with connection timeout issues and no current vendor flags.

## Summary
PhishDestroy identifies xpm8.top as a domain exhibiting characteristics consistent with generic phishing attempts. The domain shows an active status but remains under investigation due to inconclusive threat signals. The page title "522: Connection timed out" suggests potential infrastructure manipulation or hosting instability, which is often leveraged in phishing campaigns to evade detection.

Technically, xpm8.top resolves to IP address 172.67.131.15 and was registered recently on March 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with suspicious registrations. VirusTotal analysis reports zero detections from 95 security vendors, indicating no current overt malware or phishing signatures. However, the combination of domain age, registrar profile, and timeout response warrants caution and further monitoring.

At present, the domain remains active and unflagged by traditional security tools but is flagged by PhishDestroy for ongoing review. Users and security teams are advised to exercise vigilance when interacting with xpm8.top until more definitive evidence emerges. Continued observation of domain infrastructure and behavior will inform future risk assessments.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: 522: Connection timed out

## Domain Intelligence
- Registered: 2026-03-10 23:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.131.15
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: journey.ns.cloudflare.com odin.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Fortinet", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd9b2-cf23-74cf-8071-6e1433b5e1dc.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/73b25e38-4d70-445a-8f91-64da75fb848b
- PhishDestroy: https://phishdestroy.io/domain/xpm8.top/
- LLM endpoint: https://phishdestroy.io/domain/xpm8.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xpm8.top/
Last updated: 2026-03-19