com-x4[.]net

Analysis of com-x4.net, observed on July 24 2026, indicates that the domain is associated with a generic phishing campaign. The domain was registered on 10 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IPv4 address 23.27.6.208, which belongs to AS400899 Cyclone Servers located in the United States. The authoritative name servers are ns1.box.com-x4.net and ns2.box.com-x4.net. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The HTTP response returns a page whose title is "this is a mail-in-a-box", but the content of the page has not been publicly analysed beyond the title.

Threat intelligence sources corroborate the malicious classification. AlienVault OTX lists the domain in a single pulse, and PhishDestroy has actively blocked it. The domain appears on one external security blocklist. VirusTotal reports that five of ninety‑five scanned scanners flagged the domain, providing an additional indication of malicious activity. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation.

The current operational status is recorded as offline, suggesting the site may have been taken down or is no longer serving content. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no detailed page capture or sample has been released. Defenders should continue to deny any network connections to 23.27.6.208, enforce DNS blocking for com-x4.net, and monitor for any resurgence of the domain or related sub‑domains. Adding the domain to internal blocklists, updating external threat feeds, and ensuring that endpoint protection solutions are aware of the five VirusTotal detections will reduce the risk of inadvertent exposure. Ongoing observation of the registrar and hosting provider may reveal future re‑use of the infrastructure for similar campaigns.