xpm-updates[.]live

The domain xpm-updates.live is currently active and has been identified as a credential phishing vector. It was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑managed address 104.21.50.66. The web server returns HTTP 403 for direct requests and presents the generic title “Just a moment…”, a pattern commonly used to mask malicious landing pages.

The hosting infrastructure is protected by Cloudflare, as indicated by the authoritative nameservers mira.ns.cloudflare.com and emerson.ns.cloudflare.com. The IP resolves to a location in Canada, and the TLS certificate is issued by Let’s Encrypt (subject E7), confirming that the site uses standard HTTPS encryption without custom certificate anomalies. No additional hosting or CDN providers are observed.

Multiple threat feeds have flagged the domain. VirusTotal reports three out of ninety‑five scanning engines flagging the site, and it appears on one public blocklist. PhishDestroy has already blocked the domain, and AlienVault OTX includes it in a single threat pulse. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Defenders should block network traffic to 104.21.50.66 and add xpm-updates.live to URL filtering policies. Email gateways should be configured to detect and quarantine messages that reference this domain, especially those prompting credential submission. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, and any observed credential capture attempts should be reported to upstream threat intelligence platforms.