projectxai[.]org

On July 24, 2026, analysis of projectxai.org indicates that the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to 104.21.29.120, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site is protected by Cloudflare's edge services and presents the page title “Attention Required! | Cloudflare”, returning an HTTP 403 status code. The TLS certificate presented is issued by Google Trust Services under the “WE1” designation, confirming the use of a legitimate certificate chain. VirusTotal has recorded detections from six of ninety‑three scanning engines, suggesting that at least a subset of vendors identifies malicious behavior.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as a phishing‑related resource. Technology profiling shows only Cloudflare, matching the observed CDN and DNS configuration with nameservers mallory.ns.cloudflare.com and rohin.ns.cloudflare.com. The presence of a recent registration date, the use of a reputable CDN, and a valid SSL certificate are tactics commonly employed to increase credibility and evade simple blocklist checks. However, the limited number of detections and the single blocklist listing imply that broader detection coverage may be lacking.

The current offline status limits immediate threat exposure, yet the infrastructure could be re‑activated or cloned for future campaigns. Defenders should add the domain and its associated IP address to allow‑list monitoring, ensure that any residual DNS entries are observed for re‑appearance, and incorporate the TLS fingerprint (Google Trust Services / WE1) into threat‑intel feeds. Continuous re‑scanning on multi‑engine platforms such as VirusTotal is recommended to capture any changes in detection status.