xvaluefort[.]world

This domain, xvaluefort.world, was registered on 21 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is presently resolved to the IPv4 address 158.94.211.169. The authoritative name servers are a.dnspod.com, b.dnspod.com and c.dnspod.com, a configuration commonly observed in fast‑flux or disposable‑hosting setups. The domain is listed on a single security blocklist and has been added to the PhishDestroy blocklist, indicating that at least one anti‑phishing organization has observed malicious activity linked to it. VirusTotal reports that the domain has been scanned by 91 vendors; none of the scanners raised a detection at the time of analysis, but the absence of detections does not constitute assurance of legitimacy.

The threat classification supplied is “generic phishing,” suggesting the site is being used to harvest credentials or personal data. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact content and transport security unknown. Similarly, no references to an OTX feed, Safe Browsing verdict, or additional intelligence sources have been provided, so the broader malicious ecosystem surrounding the domain cannot be fully mapped.

Defenders should continue to monitor DNS resolution for changes, enforce outbound filtering for traffic to 158.94.211.169, and add xvaluefort.world to internal blocklists. Because the domain is newly created and already appears on a blocklist, proactive blocking is recommended even though current scanning services have not flagged it. Ongoing reconnaissance should include periodic re‑scans with VirusTotal or similar services, retrieval of HTTP headers, and verification of TLS usage to detect any future escalation of threat behavior.