xmtfgmjannwvopbva[.]trump[.]ldc325l[.]org[.]np

PhishDestroy identifies xmtfgmjannwvopbva.trump.ldc325l.org.np as a generic phishing threat. This domain was designed to deceive users into divulging sensitive information, though no specific brand impersonation or drainer kit has been confirmed. Its suspicious structure and subdomain naming pattern suggest an intent to appear legitimate while hosting fraudulent content.

Technical analysis reveals that this domain was created on April 23, 2026, and is registered through an unidentified registrar. It resolves to IP address 135.235.195.147 and uses a Let's Encrypt SSL certificate (R12) to appear secure. VirusTotal data shows 2 out of 95 security vendors flagging it as malicious, and it appears on 3 security blocklists. The page title was "Index of /", indicating a directory listing that could host phishing files. The domain is not listed on Google Safe Browsing, but its blocklist presence and low detection rate suggest it was active but not widely reported.

Currently, the domain is offline and has been taken down. This is a positive outcome, but residual risk remains as similar domains may reappear. Users should avoid interacting with any communications referencing this domain and report any phishing attempts. PhishDestroy recommends monitoring for related subdomains and maintaining updated security software to detect future threats.