xchibi-allocation[.]com

On 8 June 2026 the domain xchibi-allocation.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 104.21.68.174, a host that is currently listed on four independent security blocklists, including PhishDestroy, MetaMask, ScamSniffer and SEAL. VirusTotal scans have returned detections from ten of ninety‑one antivirus and URL‑reputation engines, indicating that a substantial portion of the security community regards the domain as malicious. The same blocklists have already categorized the domain as part of a generic phishing operation, and the risk rating assigned to the indicator is high. The domain’s age of less than two months aligns with typical phishing infrastructure that relies on short‑lived domains to avoid reputation buildup.

No publicly available SSL certificate details, HTTP response codes, or page‑title information have been published, leaving the exact payload and visual impersonation tactics unknown. The lack of additional intelligence such as observed credential‑stealing pages or targeted brands means the full scope of the campaign cannot be quantified at this time. Nevertheless, the convergence of multiple blocklist listings, the presence of detections across a multi‑vendor engine, and the recent creation date collectively suggest an active phishing infrastructure that is deliberately leveraging the cloud‑based IP address to serve malicious content.

Defenders should add 104.21.68.174 and the fully‑qualified domain name xchibi-allocation.com to network‑level deny lists, configure web‑proxy and DNS filtering to block resolution, and monitor for any outbound connections to the host. Continuous re‑scanning of the domain with sandbox and URL‑reputation services is recommended to capture any evolution of the hosted payload. Organizations that employ email security gateways should also ensure that messages containing links to this domain are quarantined or rejected.