xcafe-dex[.]live

The domain xcafe-dex.live was registered on May 03, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare's network (IP 172.67.221.25, located in CA). The authoritative name servers are celeste.ns.cloudflare.com and rex.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (E7) but returns HTTP 403 for direct requests. The threat rating is high and the domain remains active as of the report date.

Multiple threat‑intel sources flag the domain as malicious. AlienVault OTX lists it in one pulse, and it appears on a single security blocklist that is actively enforced by PhishDestroy. VirusTotal scans show six of ninety‑five security vendors flagging the domain as malicious, with those detections categorised as phishing or malicious URL. Gridinsoft assigns a trust score of 0 out of 100. The combination of a low trust score, vendor detections, blocklist presence, and the OTX pulse strongly suggests a phishing operation.

Publicly available artifacts do not disclose the specific phishing campaign or the targeted brand. No page content was captured due to the HTTP 403 response, and no malware payloads have been associated with the IP address beyond the generic detections. Consequently, the exact lure, credential‑stealing technique, and victim profile remain uncertain, limiting attribution and the ability to map the full kill chain.

Defenders should add xcafe-dex.live to outbound and inbound block lists, enforce DNS sinkholing for the domain, and monitor any traffic to the associated Cloudflare IP. Continuous re‑scanning of the domain with sandbox services is advised to capture any future content changes. Network telemetry should be examined for connections to 172.67.221.25, and any credential submissions that match known phishing patterns should be investigated promptly. Email gateways should be reviewed for similar lure patterns and multi‑factor authentication enforced to mitigate credential compromise.