xf[.]aafwzq[.]com

Analysis of the domain xf.aafwzq.com indicates a high‑risk malicious infrastructure that is currently active. The domain was registered on May 30, 2026 through IONOS SE, a known European registrar that offers inexpensive bulk registrations. It resolves to the IPv4 address 82.165.110.163, which is the sole A record observed in DNS queries. The authoritative nameservers for the zone are ns1.testpphpcss.shop and ns2.testpphpcss.shop, both of which are atypical and suggest a privately managed DNS setup often used by threat actors to retain quick control over the domain.

VirusTotal scans show that four out of ninety‑one security vendors have flagged the domain, indicating that multiple independent engines have identified suspicious or malicious behavior associated with the host. Additionally, the domain appears on at least one external security blocklist, reinforcing the consensus that it should be treated as hostile. The blocklist PhishDestroy has already listed xf.aafwzq.com as a malicious entry, confirming that community‑driven phishing mitigation services have observed abusive activity.

No public SSL certificate details, HTTP response codes, or page‑title information are available, leaving the exact content of the hosted site unverified. Given the combination of recent creation, dedicated nameservers, a single point of IP resolution, and multiple vendor detections, defenders should block network connections to 82.165.110.163 and add xf.aafwzq.com to local deny lists. Monitoring for any future DNS changes or additional detections is advised, as the threat actor may shift hosting or augment the infrastructure.