0xbox[.]top

The domain 0xbox.top is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers (april.ns.cloudflare.com, garret.ns.cloudflare.com) and resolves to the IPv6 address 2606:4700:3037::ac43:d266, which maps to the United States under ASN 13335 (Cloudflare, Inc.). The site returns HTTP status code 521 and the page title "522: Connection timed out," indicating that the web server is deliberately unavailable or throttled, a tactic often used to evade automated crawling. The SSL certificate presented is issued by Google Trust Services (WE1), confirming the use of a valid TLS certificate despite the underlying malicious intent.

Registration data reveals the domain was created on 18 December 2025 and is registered through 耐思尼克国际集团有限公司, a registrar based in China. Reputation services show a Gridinsoft trust score of 0/100, and five of ninety‑three VirusTotal scanners have flagged the domain. It appears on one public security blocklist and is actively blocked by PhishDestroy. The observed phishing kit is identified as an Airdrop Scam, suggesting the campaign attempts to lure victims with false cryptocurrency airdrop promises.

While the exact landing page content has not been captured, the combination of a low trust score, multiple security vendor detections, and the presence of a known scam kit provides sufficient evidence to treat 0xbox.top as a malicious actor. Defenders should add the domain to network and endpoint blocklists, monitor DNS queries for the associated IPv6 address, and ensure email security gateways are configured to detect typical airdrop‑related phishing patterns. Ongoing observation is recommended to capture any future content changes or additional infrastructure shifts.