decisions-x[.]com

Analysis of decisions-x.com shows a domain created on February 23, 2026 and hosted on Cloudflare infrastructure (IP 104.21.95.134, AS13335, United States). The domain is delegated to the Cloudflare nameservers clark.ns.cloudflare.com and joyce.ns.cloudflare.com, and it does not present an SSL certificate, indicating that any HTTPS service would be terminated or missing. The page title returned from the live endpoint reads “X. Alles, was gerade los ist / X”, which provides no direct indication of the targeted brand or service. The domain is classified as a social‑media phishing campaign, consistent with the generic phishing threat type reported.

Defensive feeds have already added the domain to three security blocklists, and it is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions. VirusTotal analysis records a single positive detection out of 93 scanning engines, confirming at least one vendor’s suspicion of malicious intent. Current operational status is offline, which may be a temporary takedown or an evasion tactic. Uncertainties remain around the specific payload or credential‑harvesting mechanism, as no sample pages or HTTP response details have been disclosed.

For defenders, the immediate recommendation is to ensure that existing web‑filtering and DNS‑sinkhole solutions block both the domain name and its resolving IP address, as the Cloudflare edge could serve additional malicious subdomains in the future. Continuous monitoring of the IP 104.21.95.134 for new hostnames, re‑evaluation of the domain’s blocklist status, and periodic VirusTotal rescans are advised. If any internal users have previously accessed decisions-x.com, credential rotation and multi‑factor authentication enforcement should be considered to mitigate potential compromise. The lack of TLS and the presence on multiple blocklists together reinforce the elevated risk rating and justify continued defensive posture.