popa-market[.]xyz

This domain, popa-market.xyz, is flagged as an active credential phishing site based on multiple technical indicators. Registered on March 11, 2026, through a Russian registrar, the domain currently resolves to 84.200.89.74, an IP address geolocated in Germany and associated with AS214036. The hosting infrastructure employs Nginx as a web server, with Cloudflare and Unpkg technologies detected, alongside HSTS enforcement and cdnjs library usage. These components suggest an attempt to mimic legitimate e-commerce or marketplace platforms while leveraging content delivery networks to obscure malicious activity. Analysis indicates the domain has been listed on at least one security blocklist, with two out of ninety-five security vendors on VirusTotal identifying it as malicious. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate the legitimacy of the site's content. The domain's nameservers, ns1.reg.ru and ns2.reg.ru, further link it to infrastructure commonly associated with phishing operations. While the page title and HTTP 200 status suggest an operational frontend, no specific brand impersonation or phishing kit has been conclusively identified in available data. Defenders should treat this domain as high-risk due to its recent registration, blocklist presence, and technical configuration. The use of Cloudflare and HSTS may complicate takedown efforts, requiring coordination with hosting providers and certificate authorities. Network-level blocking of the resolved IP and associated domain should be prioritized, alongside monitoring for related subdomains or certificate renewals. Given the domain's active status as of July 12, 2026, continued vigilance is recommended, particularly for organizations with users who may encounter marketplace-themed phishing lures.