incentive-gearbox[.]xyz

The domain incentive-gearbox.xyz was registered on April 14, 2026 through Dynadot LLC. It is currently active and resolves to the Cloudflare edge address 172.67.179.12, which is geolocated to Canada. The authoritative nameservers are jerome.ns.cloudflare.com and ollie.ns.cloudflare.com, indicating that the domain is fully proxied behind Cloudflare’s network.

Infrastructure analysis shows the site presents an HTTP 403 response and serves a TLS certificate issued by Google Trust Services under the WE1 intermediate. VirusTotal scans have flagged the domain by 3 out of 95 security vendors, and AlienVault OTX references it in a single threat pulse. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist. PhishDestroy has also listed the domain as blocked.

The page title returned is “Just a moment…”, which is commonly used by Cloudflare’s challenge pages, limiting immediate visibility into the underlying content. No additional artifacts such as phishing landing pages, credential‑harvesting forms, or malicious payloads have been observed, leaving the exact phishing vector uncertain. The limited surface suggests the operator may be using the domain to host a transient credential‑capture page that is hidden behind Cloudflare’s protection until a target accesses it.

Defenders should add incentive-gearbox.xyz to URL filtering and DNS block lists, especially for high‑risk user groups. Monitoring for outbound connections to 172.67.179.12 can help identify compromised hosts that reach the site. Because the domain is proxied through Cloudflare, standard sink‑hole techniques are ineffective; instead, rely on DNS‑level denial and endpoint web‑proxy rules. Continuous re‑scanning with VirusTotal and other sandboxes is advised to capture any future payload changes.