x2-ada[.]us

The domain x2-ada.us was registered on February 21, 2026 and is currently resolved to the Cloudflare edge address 104.21.16.1. Both authoritative nameservers, thaddeus.ns.cloudflare.com and marjory.ns.cloudflare.com, belong to Cloudflare’s DNS infrastructure, indicating the operator is leveraging a reputable CDN to mask origin servers. Threat intelligence feeds have assigned a high risk rating to the domain. VirusTotal records show that 8 of 95 scanned security vendors flag the host as malicious, and it appears on a single security blocklist. The domain is also listed as blocked by PhishDestroy, confirming that multiple independent sensors have observed abusive activity. Active probing of the site returns HTTP 403 responses, while the page title presented by the server reads “x2-ada.us | 522: Connection timed out”, a Cloudflare‑generated error indicating that the origin server failed to respond within the timeout window. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, which is typical for Cloudflare‑proxied services. The presence of HTTP/3 support further confirms modern CDN deployment. No payload or landing page content was captured, so the exact phishing lure remains unknown. Defenders should immediately block DNS resolution for x2-ada.us and add the IP 104.21.16.1 to outbound filtering rules, recognizing that the address is shared among many Cloudflare customers and may require more granular controls such as URL‑based blocking. Continuous monitoring of TLS certificate changes and any shift in HTTP response codes is advised, as the operator may switch to a live credential‑stealing page. Organizations should also feed the indicator into internal threat‑intel platforms to correlate with possible credential‑theft incidents.