xpboom[.]com

Analysis as of July 24 2026 indicates that xpboom.com is associated with a crypto‑focused phishing operation. The domain was registered on 25 February 2025 through NameSilo, LLC and is currently listed as taken offline. DNS resolution points to the IPv4 address 69.5.189.54, which belongs to AS42624 (Global‑Data System IT Corporation) and is geolocated in Switzerland. No TLS certificate is presented, meaning the site was served only over HTTP, a common characteristic of low‑trust malicious pages. The public page title “XPBOOM | Play at the best online casino based on Blockchain” aligns with the “Gambler Scam” kit observed in other cryptocurrency‑related phishing campaigns.

Five of ninety‑five VirusTotal scanners flagged the domain, suggesting the presence of malicious components despite the relatively low detection ratio. Gridinsoft assigned a trust score of 8 out of 100, reinforcing the assessment of high risk. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one external sinkhole has identified it as malicious. AlienVault OTX recorded the domain in one threat‑intelligence pulse, providing additional corroboration of its use in fraudulent activity. The nameserver set consists of ns1.nameserverhub.com through ns4.nameserver, a configuration often observed in disposable hosting used for short‑lived phishing sites.

Because the site is offline, active payloads cannot be inspected, and the exact content of the landing page remains unverified beyond the title. Defenders should continue to block traffic to 69.5.189.54 and to xpboom.com at the DNS level, monitor for any re‑registration of the domain, and add the IP to internal reputation lists. Network sensors should flag HTTP requests lacking TLS to this address, and any email or social‑engineering campaigns referencing “XPBOOM” or blockchain casino offers should be treated as suspicious.