perform-x[.]nl

This domain, perform-x.nl, is flagged as a crypto-related phishing site by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, as of July 23, 2026. Infrastructure analysis reveals the domain was registered on February 23, 2026, through Domain Robot and is currently offline, returning an HTTP 502 status. It resolves to IP 3.64.230.132, hosted on Amazon.com, Inc. (AS16509) in Germany, with nameservers docks05.rzone.de and shades03.rzone.de. The SSL certificate is issued by Let's Encrypt (E7), and the detected technology is Nginx.

The page title, 'PerformX - Performance Testing,' does not explicitly confirm the phishing target, but the presence on three security blocklists and detection by MetaMask suggests a focus on cryptocurrency users. Two of 93 security vendors on VirusTotal flagged the domain, though this does not provide conclusive evidence of malicious activity. The domain's MX records point to smtp.rzone.de, which may indicate email infrastructure used for phishing campaigns.

Defenders should treat this domain as high-risk for crypto-related phishing, particularly given its inclusion on MetaMask's blocklist. No evidence of active exploitation is currently observed due to its offline status, but historical activity and infrastructure warrant continued monitoring. Organizations should block traffic to this domain and investigate any prior connections from internal networks.