xdnaprotocol[.]com

Analysis of xdnaprotocol.com, created on July 15 2026 and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, shows a recent infrastructure deployment that aligns with the reported generic phishing activity. The domain resolves to the IP address 188.114.97.3 and is served by Cloudflare nameservers heidi.ns.cloudflare.com and thaddeus.ns.cloudflare.com, indicating use of a reputable CDN provider to obscure the true origin of the web server. The domain has been added to at least one security blocklist and is actively blocked by the PhishDestroy service, confirming that threat intelligence feeds have identified it as malicious. A VirusTotal scan performed by 91 antivirus and URL scanning engines returned no detections; however, the absence of detections does not constitute evidence of benign behavior and should be interpreted in the context of other indicators. No public Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, trust score metrics, page title, or additional evidence links are currently available, leaving those aspects of the host unverified. Defenders should treat xdnaprotocol.com as a high‑confidence phishing indicator based on its registration date, blocklist inclusion, and active blocking by PhishDestroy. Recommended actions include updating firewall and proxy deny lists to include the domain and its resolving IP, monitoring for any outbound connections to the IP address, and applying URL filtering rules that block access to the domain. Continuous re‑evaluation is advised, as additional intelligence such as SSL certificate analysis, page content inspection, or further blocklist appearances may emerge and refine the risk posture.