xa18k-cointelegraph[.]com

Analysis of xa18k-cointelegraph.com shows a high‑risk phishing infrastructure that remains active as of the report date, July 23, 2026. The domain resolves to the Cloudflare‑managed address 188.114.96.3, which is associated with AS13335, a known content‑delivery network. The site uses a Google Trust Services certificate (WE1) issued by a legitimate CA, but the presence of a valid TLS certificate does not mitigate the malicious intent. The HTTP response code is 521, indicating that the origin server is refusing connections, a pattern frequently observed in phishing sites that employ Cloudflare front‑ends to hide backend activity. The page title, "Elon Musk Officially Launches XA18K ICO," suggests a cryptocurrency‑related lure targeting investors familiar with high‑profile figures. The underlying stack includes WordPress, MySQL, PHP, Vue.js, and jQuery, confirming a typical web‑application environment, while Google Tag Manager, Google Analytics, and Cloudflare Browser Insights indicate tracking components that may be used for credential harvesting or traffic profiling.

The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited, and the authoritative nameservers are eric.ns.cloudflare.com and vita.ns.cloudflare.com, both Cloudflare‑operated. Reputation data shows a Gridinsoft trust score of 0 out of 100 and presence on a single security blocklist, confirming its malicious classification. PhishDestroy has already blocked the domain, and two of ninety‑three VirusTotal scanners flag it as malicious, providing additional confidence in the threat assessment. No further public analysis of the page content is available, leaving the exact phishing mechanics uncertain.

Defenders should block the domain and its associated IP at perimeter firewalls and DNS filtering layers. Update URL filtering policies to include xa18k-cointelegraph.com and monitor for any outbound connections to the IP 188.114.96.3.