xchange-planet[.]com

Analysis of xchange-planet.com indicates that the domain was registered through NameCheap, Inc. on 6 March 2026 and is currently taken offline. DNS resolution points to the IPv4 address 66.45.23.50, which belongs to AS19853 operated by OrangeHost in the United States. The authoritative name servers are dns101.registrar-servers.com and dns102.registrar-servers.com. A Let’s Encrypt certificate identified as R12 is active for the host, confirming the presence of TLS encryption at the time of observation. The page title returned by HTTP requests reads “Xchange Planet || Home”, but no further page content has been captured.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal reports a single positive detection out of ninety‑five scanned scanners, indicating that at least one security vendor has flagged the site as malicious. No additional public threat‑intel feeds such as OTX or Safe Browsing entries are referenced in the available data. Given the recent creation date, the association with a known phishing‑blocking list, and the single vendor detection, the infrastructure appears to have been used for a short‑lived generic phishing campaign before being taken offline.

However, the lack of detailed payload samples, landing‑page screenshots, or victim reports leaves the exact phishing vector and targeted brand undefined. Defenders should continue to monitor the IP address 66.45.23.50 for any resurgence of activity, enforce blocklisting of the domain in corporate web filters, and include the associated name servers in any DNS‑sinkhole configurations. Because the certificate is publicly trusted, future reuse of the same host could evade simple certificate‑based checks, so heuristic or behavior‑based detection is recommended. Threat‑intel teams may also consider querying NameCheap for any related domains registered under the same account to anticipate potential re‑use of the infrastructure.