xa500k[.]net

On July 22, 2026, analysts examined the domain xa500k.net, which was registered on February 21, 2026 through NiceNIC International Group Co., Limited. The domain resolves to IP address 172.67.142.149, an address owned by AS13335 Cloudflare, Inc., indicating that the infrastructure is protected by Cloudflare’s edge services. DNS resolution uses the Cloudflare nameservers ashley.ns.cloudflare.com and jermaine.ns.cloudflare.com, and the detected technology stack is limited to Cloudflare. An HTTPS connection is presented with a certificate issued by Google Trust Services under the WE1 designation, confirming a valid TLS layer despite the malicious intent.

Web probing returned an HTTP 403 status code, and the page title reported was "404 Not Found," suggesting that the landing page is either removed or deliberately hidden. The domain is presently marked as offline and has been taken down, yet historical data shows that it was flagged by multiple security services. VirusTotal records indicate that four of ninety‑five scanning engines identified the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist. AlienVault OTX lists the domain in a single threat‑intel pulse, and PhishDestroy has explicitly blocked the domain.

While the specific brand or credential‑harvesting target of the phishing campaign is not disclosed in the available intelligence, the classification as generic phishing remains supported by the detection profile and blocklist presence. Uncertainty remains regarding the exact content that was served prior to takedown, as no visual or page‑level artifacts have been captured. Defenders should immediately block xa500k.net at perimeter and endpoint layers, monitor for any resurgence of the host under the same IP or nameserver configuration, and incorporate the domain into threat‑intel feeds.