xihlukeit[.]com

Analysis of xihlukeit.com shows the domain was registered on March 6, 2026 through GoDaddy.com, LLC. The authoritative nameservers are grannbo.ns.cloudflare.com and noah.ns.cloudflare.com, indicating that the zone is hosted on Cloudflare’s network. DNS resolution points to IP address 104.21.60.93, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. The site presented a TLS certificate issued by Let’s Encrypt (identifier “E7”), confirming that HTTPS was enabled. An HTTP request returned a 403 status code, suggesting the site is currently inaccessible or deliberately restricted, and the domain is listed as offline in threat‑intelligence feeds.

The page title retrieved from the domain reads “Xihlukeit — Secure Cryptocurrency Trading Platform,” and the threat classification is recorded as a “Fake Exchange.” VirusTotal records indicate that 1 of 95 scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist, specifically PhishDestroy, which has taken the domain down. The combination of a recent creation date, a reputable registrar, Cloudflare hosting, a legitimate‑looking TLS certificate, and a cryptocurrency‑focused title is consistent with a typical credential‑harvesting or financial‑fraud operation that masquerades as a legitimate trading platform. While the limited number of vendor detections suggests a low detection coverage, the presence on a phishing blocklist and the explicit “Fake Exchange” label provide sufficient confidence to treat the domain as malicious.

Uncertainty remains regarding the exact payload or credential‑capture mechanisms, as no page content analysis is available beyond the title. Defenders should add the domain to deny‑list rules at network and endpoint layers, monitor for DNS queries to the associated IP range, and consider tightening email filters for any communications referencing “Xihlukeit” or similar cryptocurrency‑trading language.