xpmarket[.]net

This domain is flagged as an active cryptocurrency wallet phishing site designed to deceive users into disclosing XRP Ledger (XRPL) credentials. The site mimics legitimate decentralized exchange (DEX) and NFT platforms, presenting itself as a Web3 gateway under the title 'XPMarket: Your Web3 Gateway to XRPL - DEX, NFTs, Tokens.' Victims are likely lured through social engineering tactics, such as fake airdrop promotions or fraudulent investment opportunities, and prompted to connect their crypto wallets to the malicious interface. Once connected, sensitive private keys or recovery phrases may be harvested, leading to unauthorized access and theft of digital assets. Analysis indicates the domain was registered on April 9, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged the domain as malicious, and it appears on at least one security blocklist. The SSL certificate, issued by Let’s Encrypt, does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. Users who have visited www.xpmarket.net or interacted with its content should immediately revoke any wallet connections made to the site. If credentials were entered, affected wallets should be considered compromised, and all funds should be transferred to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security resources. Avoid clicking on links from unsolicited messages or social media promotions, and verify the authenticity of Web3 platforms through official documentation or community-verified sources.