xmart-dex[.]live

The domain xmart-dex.live was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is presently designated as a generic phishing site and remains active as of the report date, July 12, 2026. The recent creation date and lack of historical presence are consistent with infrastructure that is rapidly deployed for credential‑harvesting operations.

Infrastructure analysis shows the domain resolves to the Cloudflare address 172.67.207.168, which is geolocated to Canada and hosted by Cloudflare, Inc. The authoritative nameservers are noor.ns.cloudflare.com and armfazh.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. TLS termination is provided by a Let’s Encrypt certificate (issuer E8), and HTTP requests return a 403 status code, indicating that direct content retrieval is blocked while the site likely serves malicious payloads only to specific user agents or after additional checks.

Reputation services provide further evidence of abuse. VirusTotal records three positive detections out of ninety‑five scanning engines, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and has been cited in one AlienVault OTX pulse. Additionally, the anti‑phishing feed PhishDestroy has already blocked the domain, confirming that it has been observed delivering phishing content.

Defenders should add xmart-dex.live to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare IP and nameservers, and enforce TLS inspection to detect any hidden payloads behind the 403 response. Users should be warned that any unsolicited request for credentials originating from this domain is likely fraudulent, and credential‑reset procedures should be initiated if exposure is suspected. Continuous threat‑intel feeds should be consulted for any new indicators related to this infrastructure.