xpmarkets[.]app

The domain xpmarkets.app was registered on July 31 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 188.114.96.3. Authoritative name servers are jonah.ns.cloudflare.com and rose.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare's DNS and CDN services. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, which classifies it as a generic phishing campaign. VirusTotal has processed the domain with 91 independent scanning engines; none of the engines reported a detection at the time of analysis, but the absence of detections does not constitute evidence of benign behavior.

No public SSL certificate details, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) references are available in the current intelligence set, and the page title or content has not been captured. Consequently, the precise malicious payload, target brand, or phishing lure remains unknown. Infrastructure analysis shows the IP belongs to Cloudflare's edge network, a common choice for threat actors seeking to obscure the true origin of malicious services.

Defenders should treat xpmarkets.app as a high‑confidence phishing indicator based on its blocklist presence and PhishDestroy classification. Recommended actions include adding the domain and its resolving IP to DNS and URL filtering policies, monitoring for future detections in additional threat feeds, and, where feasible, employing sinkholing or sandbox analysis of any resolved content. Continuous re‑evaluation is advised as new telemetry (e.g., HTTP status, page content, or additional vendor detections) becomes available.