leaderboard[.]xmaquina[.]io

The domain leaderboard.xmaquina.io has been identified as a high‑risk generic phishing infrastructure. It was first observed by multiple blocklist operators, including PhishDestroy and ScamSniffer, and remains active as of the report date. The domain’s page title is reported as "XMAQUINA," but no further content analysis is available.

Infrastructure analysis shows that leaderboard.xmaquina.io resolves to the IP address 188.114.97.3, which is hosted within the Cloudflare network (AS13335) and geolocated to the United States. The domain is protected by an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS handshake. HTTP requests to the site return a 526 status code, suggesting an origin‑server error that may be used to obscure the underlying payload. DNS resolution is delegated to kurt.ns.cloudflare.com and mina.ns.cloudflare.com, both Cloudflare name servers, and the site serves over HTTP/3, confirming modern protocol usage.

Registration data reveals that the domain was created on February 16, 2024, through GoDaddy.com, LLC. It appears on two public security blocklists and has been flagged by two of ninety‑five VirusTotal scanners, indicating limited but notable detection by security vendors. No phishing kit, brand target, or specific lure has been extracted from the site, and the page content beyond the title has not been publicly disclosed, leaving the exact victim‑facing tactics uncertain.

Defenders should prioritize blocking DNS resolution for leaderboard.xmaquina.io and any subdomains, enforce TLS inspection to capture potential malicious payloads despite the valid certificate, and monitor for related Cloudflare‑hosted infrastructure that may be leveraged for similar campaigns. Continuous re‑evaluation of VirusTotal and blocklist status is recommended, as additional detections may surface as the campaign evolves.