xplrewards[.]live

Analysis of the domain xplrewards.live indicates active credential phishing infrastructure as of July 12, 2026. The domain was registered on July 5, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 104.21.17.167, part of AS13335 (Cloudflare, Inc.), a network commonly used to obscure malicious endpoints. The domain is protected by Cloudflare nameservers (jerome.ns.cloudflare.com and kristina.ns.cloudflare.com) and employs HTTP/3 and HSTS, techniques often leveraged to evade detection and inspection. Security vendors have flagged the domain, with 5 of 91 engines on VirusTotal identifying it as malicious. It appears on three security blocklists and is actively blocked by at least three mitigation systems. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing campaigns routinely use valid certificates to appear legitimate. The current HTTP status of 403 and page title 'Just a moment...' suggest the site may be in a transitional state or employing anti-crawling measures, though the underlying infrastructure remains operational. Defenders should treat this domain as high-risk for credential harvesting. The absence of a confirmed brand target or phishing kit in available data limits attribution, but the domain's configuration aligns with known phishing patterns. Network-level blocking of 104.21.17.167 and monitoring for related domains registered through the same registrar are recommended. Further analysis of the site's content, if accessible, may clarify the specific lure or targeted entities.