xpmlabs[.]info

PhishDestroy identifies xpmlabs.info as an active credential harvesting phishing domain targeting unsuspecting users through deceptive login portals. This domain leverages social engineering tactics to trick victims into submitting sensitive credentials under false pretenses, posing a direct threat to personal and corporate account security. The infrastructure and operational tactics employed suggest opportunistic credential theft rather than targeted espionage or financial fraud campaigns.

This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but confirmed malicious activity. It resolves to IP 188.114.96.3, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was created on April 09, 2026. It utilizes a Let's Encrypt SSL certificate to enhance perceived legitimacy, a common tactic employed by phishing operators to bypass browser warnings. The domain remains active and has not been widely blocked at scale, warranting elevated caution.

As of seed 21fd06, this domain is assessed with an elevated risk profile due to its active status and use of HTTPS. Users and organizations are advised to block access to xpmlabs.info at the network and DNS levels. Avoid entering credentials or personal information on any page hosted on this domain. Security teams should monitor for outbound connections to 188.114.96.3 and inspect DNS logs for resolution attempts. Always verify URLs via reputable threat intelligence platforms before interaction. Exercise heightened scrutiny with recently registered domains utilizing free SSL certificates.