xpeedprimetrad[.]world

The domain xpeedprimetrad.world was registered on March 04, 2026 through OwnRegistrar, Inc. It is currently active and returns an HTTP 302 redirect. The site presents the page title “XPEED TRADERS,” which aligns with the branding used in the observed phishing lure. The domain’s age of only a few months is consistent with fast‑deployment of malicious infrastructure.

Infrastructure analysis shows the domain resolves to IP 38.242.228.157, hosted in France and assigned to AS51167 (Contabo GmbH). Authoritative name servers are ns5.asurahosting.com and ns6.asurahosting.com, and the domain publishes an MX record pointing to itself with priority 0. The TLS certificate is a Let’s Encrypt R13 issuance, indicating a standard automated certificate without custom validation.

Reputation signals reinforce the malicious assessment. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 2 of 95 security vendors have flagged the domain. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. These indicators collectively suggest the site is being used for generic phishing, likely to harvest credentials under the “XPEED” brand.

Defenders should prioritize immediate blocking of the domain and its resolved IP address at network perimeter and DNS layers. Continuous monitoring of the associated nameservers and MX record is advised, as changes may indicate pivoting to additional malicious services. Where feasible, sinkholing the IP or redirecting traffic to a safe page can disrupt the phishing campaign while forensic collection proceeds.