xa18k[.]com

The domain xa18k.com was observed hosting a page titled “XA18K Official Website Presale Get Up to 200% Bonus!” and is currently classified as a generic phishing site. The site is protected by Cloudflare and serves content over HTTP/3, returning an HTTP 403 status code at the time of analysis. DNS resolution points to the IP address 172.67.178.178, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid, publicly trusted certificate chain. Registration records show the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, and the authoritative nameservers are eric.ns.cloudflare.com and vita.ns.cloudflare.com.

Threat intelligence aggregators have raised alerts on xa18k.com. VirusTotal reports that 14 of 93 scanned security vendors flagged the domain, suggesting a consensus of malicious intent. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. The PhishDestroy sinkhole has already taken the domain offline, and the current HTTP response is a 403, indicating the site is no longer serving its malicious payload.

While the page title implies a financial incentive scheme, no additional content or phishing kit artifacts have been captured, leaving the exact lure and credential‑stealing mechanisms uncertain. Defenders should add xa18k.com to network‑level blocklists, enforce DNS filtering, and monitor for any re‑hosting attempts that might use the same IP range or Cloudflare configuration. Continuous re‑scanning with multi‑vendor platforms such as VirusTotal is advised to capture any changes in detection status. The combination of a low trust score, multiple vendor detections, and active takedown by PhishDestroy supports a high confidence classification as a phishing infrastructure element.