service-xoom-be[.]com

Analysis of the domain service-xoom-be.com indicates it is an active phishing site impersonating Xoom, a PayPal-owned digital money transfer service. The domain was registered on August 04, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. As of August 06, 2026, the domain resolves to the IP address 180.178.180.159, which has been linked to previous phishing campaigns targeting financial services. The domain appears on one security blocklist and is blocked by PhishDestroy, a specialized anti-phishing vendor.

VirusTotal reports that 2 out of 91 security vendors flag this domain as malicious, suggesting early detection but not yet widespread recognition. Infrastructure analysis reveals no SSL certificate details or HTTP status codes from the provided data, limiting assessment of encryption or server behavior. The exact content of the site remains unanalyzed, though the domain name and known phishing classification strongly suggest it is designed to harvest user credentials or payment details under the guise of Xoom’s legitimate service. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or proxy level.

Network logs should be reviewed for connections to 180.178.180.159 or the domain itself, particularly from endpoints handling financial transactions. Given the domain’s recent registration and limited detection coverage, additional monitoring for related domains using similar naming conventions (e.g., 'xoom' variants) is recommended. No evidence links this domain to a specific phishing kit or advanced evasion techniques at this time.