xpljy[.]com

This domain, xpljy.com, is flagged as a generic phishing threat designed to harvest user credentials through spoofed login portals. Analysis indicates no direct association with a specific brand or drainer kit, though the infrastructure mimics legitimate authentication pages to deceive targets. The domain exhibits characteristics typical of credential-theft campaigns, including obfuscated redirects and form submissions to attacker-controlled endpoints. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.0.156 and was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown efforts or infrastructure rotation by the threat actor. However, residual risk persists, as associated IP addresses or newly registered domains may re-emerge under similar naming conventions. Organizations are advised to monitor for DNS requests to 104.21.0.156 and audit logs for connections to xpljy.com prior to its deactivation. Blocklisting the domain and its resolved IP at perimeter defenses is recommended to prevent potential re-exposure.