2473-x[.]com

The domain 2473-x.com was created on February 23, 2026 through NiceNIC International Group Co., Limited and is presently listed as offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2a06:98c1:3121::3, which is hosted by Cloudflare (AS13335) in the United States. Cloudflare services are confirmed by the presence of the nameservers imani.ns.cloudflare.com and nikon.ns.cloudflare.com, and the site was observed using HTTP/3. The web server returned an HTTP 403 status code, and the page title reported by the scanner is "Mining Pool," which does not directly reveal the phishing content.

SSL inspection indicates the certificate is issued by Google Trust Services under the WE1 label, confirming a valid TLS handshake. Malware and URL reputation services on VirusTotal flagged the domain in four of ninety‑three vendor scans, and the domain appears on one external security blocklist. PhishDestroy has also categorized and blocked the domain, identifying the campaign as a Social Media Phishing operation. The evidence points to a typical phishing infrastructure that leverages Cloudflare’s CDN to obscure origin, employs a legitimate‑looking TLS certificate, and serves a page that currently returns a forbidden response.

What remains uncertain is the exact phishing payload, the targeted social media platform, and whether any active credential‑stealing pages were ever served before takedown. Defenders should continue to block 2473-x.com at network perimeters, update DNS filtering policies, and add the domain to internal blocklists. Monitoring of related Cloudflare‑hosted IP ranges and the associated nameservers is advisable, as threat actors may reuse the same infrastructure for future campaigns. Awareness training should remind users that malicious links may appear to reference unrelated services such as mining pools, but the underlying intent is credential harvesting via social media channels.