xpior-pay[.]icu

This domain is flagged as an elevated-risk credential theft operation targeting users of Xplor Pay, a payment processing platform formerly known as Clearent. Analysis indicates the site employs brand impersonation tactics to harvest login credentials, posing significant financial and operational risks to businesses and end-users in the payment ecosystem. Infrastructure analysis reveals the domain xpior-pay.icu was registered on February 24, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. The domain resolves to IP address 212.22.90.25 and is currently offline, though historical data shows it utilized Vue.js and Nginx technologies. Security vendors on VirusTotal flagged the domain at a 7/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is specifically blocked by PhishDestroy, further corroborating its malicious intent. Organizations and individuals should implement immediate mitigation measures to counter this credential theft threat. Network-level protections should include DNS filtering to block resolution of xpior-pay.icu and its associated IP 212.22.90.25. Endpoint security controls must be updated to detect and prevent access to the domain, while email security gateways should quarantine any messages containing links to this site. Users who may have interacted with the domain should be directed to reset credentials for Xplor Pay and any other accounts where identical login details were reused. Security teams should monitor for anomalous authentication attempts, particularly those originating from the identified IP range, and conduct retrospective log analysis to identify potential prior compromises.