xmarket[.]ngrok[.]app

The domain xmarket.ngrok.app was a phishing site engaged in brand impersonation, specifically targeting Google users. It posed as a legitimate service under the guise of 'Xmarket - The creator-owned prediction market' to deceive victims into providing sensitive information, classified as a tech-support scam. No crypto drainer kit was detected. The site is currently taken offline, but its previous activity warrants caution for those who may have interacted with it.

xmarket.ngrok.app was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Gridinsoft. It appeared on 2 security blocklists, PhishDestroy and ScamSniffer, and was registered through Namecheap Inc. The domain resolved to the IP address 3.64.155.7, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The SSL certificate was issued by Let's Encrypt (E7), and the observed page title was 'Xmarket - The creator-owned prediction market'. Detected technologies included Node.js, PHP, Windows Server, OpenSSL, Express, and Apache HTTP Server. Google Safe Browsing did not flag the domain at the time of analysis.

Individuals who visited xmarket.ngrok.app should change any passwords entered on the site and enable two-factor authentication (2FA) on associated accounts to prevent unauthorized access. Monitor financial and online accounts for suspicious activity, and report the incident to Google's anti-phishing team via their official reporting page. If personal or financial data was compromised, consider filing a report with local cybercrime authorities or platforms like the FBI's Internet Crime Complaint Center (IC3).