xpresspaypoint[.]com

The domain xpresspaypoint.com was registered on March 23, 2026 and is currently active. DNS resolution points to IP 198.251.84.200, which is geolocated to Luxembourg and associated with FranTech Solutions. The authoritative nameservers are ns5.asurahosting.com and ns6.asurahosting.com. An SSL certificate issued by Let’s Encrypt (R12) is in place, and the web server responds with HTTP 200 over HTTP/3, indicating a live site. The page title returned by the server is "Home - XPress Pay Point," and the site employs Tailwind CSS, LiteSpeed, Alpine.js, Smartsupp, and jsDelivr, suggesting a modern e‑commerce front end. VirusTotal reports that 14 of 94 security vendors have flagged the domain, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one public blocklist and is listed as blocked by PhishDestroy. AlienVault OTX cites the domain in 23 threat‑intelligence pulses, reinforcing its association with malicious activity. The scam type is identified as an e‑commerce phishing operation. Defenders should immediately block the domain at perimeter and endpoint controls, monitor DNS queries for the associated IP and nameservers, and consider sinkholing the IP range. Ongoing observation is required to capture any payloads or credential‑stealing forms that may be deployed, as the specific content of the page beyond its title has not been publicly disclosed.