xpmarketxrlusd[.]com

This domain, xpmarketxrlusd.com, is identified as a fraudulent allocation claim portal designed to harvest user credentials and sensitive financial information through deceptive phishing tactics. The site mimics legitimate token allocation or airdrop portals, presenting itself as an "XP Market × RLUSD — Allocation Claim Portal" to lure victims into entering private keys, wallet credentials, or personal data under false pretenses. Such schemes are commonly used to facilitate unauthorized access to cryptocurrency wallets, leading to direct asset theft or identity compromise. The use of urgency-driven language and spoofed branding increases the likelihood of successful exploitation, particularly among users expecting legitimate token distributions. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain was registered on June 09, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and is currently flagged by 7 out of 95 security vendors on VirusTotal, including detection as a phishing resource. Furthermore, the domain appears on two independent security blocklists and has been actively blocked by multiple threat intelligence platforms. The creation date in the future (2026) is anomalous and suggests domain spoofing or incorrect WHOIS data, a common tactic to evade detection and extend operational lifespan. Users who have visited xpmarketxrlusd.com or interacted with its content should take immediate corrective action. All credentials, private keys, or recovery phrases entered on the site must be considered compromised and revoked without delay. Affected individuals should transfer any at-risk assets to new, secure wallets using fresh seed phrases and enable multi-factor authentication on all associated accounts. It is also recommended to monitor financial and identity systems for unauthorized activity and report the incident to relevant cybersecurity response teams. The domain is currently offline, but similar threats may re-emerge under different infrastructure; vigilance and verification of official sources are strongly advised.