xtoadz-update[.]live

This domain, xtoadz-update.live, has been classified as a credential phishing site and is currently active with a high risk rating. The domain was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately began serving HTTPS content using a Let’s Encrypt certificate issued by the E8 intermediate authority. The authoritative name servers are olga.ns.cloudflare.com and kevin.ns.cloudflare.com, both pointing to Cloudflare’s network. DNS resolution returns the IP address 188.114.97.3, which is associated with Cloudflare, Inc. located in Canada. The TLS certificate is valid, indicating that the operator has obtained a free certificate to lend legitimacy to the phishing page. Network‑level scans show the web server responding with HTTP 403, suggesting that the site may be restricting access to specific user‑agents or referrers. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. AlienVault OTX records a single pulse referencing this domain, and VirusTotal reports that eight out of ninety‑five scanners have flagged it as malicious, reinforcing the high‑risk assessment. Publicly available evidence does not reveal the exact brand or service being impersonated, nor does it disclose the content of the credential‑harvesting form. The limited HTTP response prevents a full page analysis, leaving the specific tactics and payload delivery mechanisms uncertain. Defenders should add xtoadz-update.live to blocklists at the DNS and proxy levels, restrict outbound connections to its Cloudflare IP, and monitor for any authentication attempts to corporate services that originate from this address. Continuous re‑query of the domain’s DNS records and periodic rescanning with updated malware engines are recommended to capture any changes in hosting or content.