feedbacks-x[.]com

Feedbacks-x.com is flagged as a high‑risk, active generic phishing domain that primarily targets social media users. The domain was registered on December 13, 2025 through Dynadot LLC and resolves to the Cloudflare‑owned address 172.67.139.18, ASN AS13335, located in the United States. DNS configuration shows the authoritative nameservers carioca.ns.cloudflare.com and nero.ns.cloudflare.com, confirming the use of Cloudflare’s edge infrastructure. The site serves content over HTTPS using a Google Trust Services / WE1 certificate, but the page title returned by the HTTP response is simply "Loading" and the HTTP status code is 521, indicating that the origin server is refusing connections, a pattern often observed with malicious hosting that relies on Cloudflare to hide the backend.

Email infrastructure is present: MX records point to mx1.improvmx.com (priority 10) and mx2.improvmx.com (priority 20), suggesting the domain may be used for credential‑ harvesting via phishing emails. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has actively blocked it. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain, reinforcing the suspicion despite the limited detection count. The combination of a recent registration, Cloudflare‑based hosting, a generic "Loading" title, and an HTTP 521 response aligns with known social‑media phishing campaigns that lure victims with deceptive links.

Uncertainty remains around the specific payload or credential‑capture mechanisms, as no detailed page content has been observed. Defenders should block network connections to 172.67.139.18, add feedbacks-x.com to URL filtering lists, monitor outbound email traffic for the improvmx MX hosts, and enforce strict safe‑browsing controls. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds are recommended to capture any evolving indicators.