xa34p[.]cfd

Analysis of xa34p.cfd as of July 23, 2026 indicates that the domain was created on February 21, 2026 through the registrar NiceNIC International Group Co., Limited. The authoritative name servers dean.ns.cloudflare.com and luciane.ns.cloudflare.com resolve the domain to the IP address 172.67.156.70, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. No TLS certificate was presented, suggesting the site was served over plain HTTP or that the certificate was absent at the time of observation. VirusTotal has flagged the domain in 15 of 93 scanned security engines, demonstrating a moderate level of detection across multiple vendors. AlienVault Open Threat Exchange records the domain in a single threat intelligence pulse, and it appears on one external blocklist.

PhishDestroy has listed the domain as blocked, and the current operational status is reported as offline. The harvested page title, “XA34P Official Website Pre-sale Get Up to 200% Bonus!”, implies a promotional or investment‑related lure, consistent with the generic phishing classification. The available evidence confirms that the domain is part of an infrastructure hosted behind Cloudflare’s CDN, leveraging the registrar NiceNIC. While the lack of an SSL certificate may hinder encrypted communication, the presence of multiple detections and blocklist entries indicates that security products have recognized the site as malicious.

Uncertainty remains regarding the full scope of the phishing campaign, such as the specific victim targeting or any credential‑ harvesting mechanisms, because no content analysis or payload details have been disclosed. Defenders should continue to block or sinkhole the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators (domain name, IP address, name servers, creation date, and detection counts), and monitor for any resurgence of the domain after the current offline state.