xpresscoins[.]xyz

Analysis of the domain xpresscoins.xyz indicates that it is actively being used for a high‑risk generic phishing campaign. The domain was registered on May 20, 2025 through GoDaddy.com, LLC and is serviced by the default GoDaddy name servers ns21.domaincontrol.com and ns22.domaincontrol.com. DNS resolution points to the IPv4 address 72.60.32.118, which remains reachable as of the report date, July 30, 2026, confirming that the infrastructure is still live. VirusTotal records show that three out of ninety‑one scanning engines have flagged the domain, providing early indication of malicious intent.

Independent community mitigation lists have already incorporated the domain; it appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, demonstrating that multiple defensive platforms recognize its threat. No additional telemetry such as Safe Browsing alerts, Open Threat Exchange (OTX) indicators, SSL certificate details, HTTP response codes, trust scores, or page title information is currently available in public repositories. Consequently, the precise phishing lure, target brand, or credential‑harvesting page layout cannot be confirmed at this time.

Defenders should prioritize immediate containment actions: add the domain and its resolving IP address to network‑level deny lists, enforce DNS sinkholing where feasible, and monitor for any traffic patterns that reference the GoDaddy name servers or the 72.60.32.118 host. Given the recent registration date and active status, continuous re‑evaluation of the domain is advised to capture any evolution in the campaign, such as the deployment of additional infrastructure or changes to the hosting environment. Organizations that rely on email or web gateway filtering should ensure that their rules incorporate the latest blocklist entries for xpresscoins.xyz to mitigate exposure to this high‑risk phishing vector.