0xmas[.]top

Analysis indicates that the domain 0xmas.top was registered on December 23, 2025 through the registrar 耐思尼克国际集团有限公司. The domain resolves to the IP address 172.67.205.221, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. DNS resolution uses the Cloudflare authoritative nameservers brenna.ns.cloudflare.com and coby.ns.cloudflare.com, indicating that the infrastructure is fully proxied behind Cloudflare’s edge network. The site serves an HTTPS certificate issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS certificate despite the malicious intent. HTTP requests receive a 301 redirect and the final page title reports “522: Connection timed out”, a Cloudflare error page that suggests the origin server is not responding.

Front‑end technology fingerprints include AngularJS, HTTP/3 support, HSTS enforcement, and Cloudflare Browser Insights, all of which are typical of modern abuse kits hosted on shared infrastructure. The observed kit is identified as an “Airdrop Scam”, a common cryptocurrency‑related lure that promises free token distributions in exchange for personal credentials. Reputation data shows that 0xmas.top is currently blocked by the PhishDestroy feed and appears on one additional security blocklist. VirusTotal has recorded six detections out of ninety‑three scanned engines, reinforcing the malicious classification. Independent scoring from Gridinsoft assigns a trust rating of 0 out of 100, indicating an extremely high risk posture.

Given the combination of a recent registration, Cloudflare‑proxied hosting, a valid TLS certificate, and multiple independent detections, the domain should be treated as a high‑confidence malicious indicator. Defenders should add 0xmas.top to network deny lists, enforce URL filtering to block HTTP and HTTPS connections, and monitor for any outbound requests to the associated IP address.