xa98b[.]info

The domain xa98b.info is identified as a fake login phishing domain and is currently offline. This domain was designed to trick users into providing sensitive information by mimicking a legitimate login page. The domain was created on October 15, 2025, and is registered through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.133.207, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network.

Analysis indicates that xa98b.info has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the cybersecurity community. The domain appears on one security blocklist, specifically PhishDestroy. The SSL certificate for the domain is issued by Google Trust Services / WE1, which could be a tactic to gain user trust. The elevated risk level is justified by the combination of these indicators, as they suggest that the domain was actively used for phishing attacks before being taken offline.

The current status of xa98b.info is offline, which reduces the immediate threat to users. However, the domain's infrastructure and history indicate that it could be reactivated at any time. Security teams are advised to monitor for any signs of reactivation and to update their blocklists accordingly. Users should be educated to verify the legitimacy of login pages by checking the URL and SSL certificate, and to report any suspicious activity to their security teams.