xs992[.]com

Analysis of the domain xs992.com indicates it was operating as a phishing site targeting users with a Bitpay Quant theme, as evidenced by the page title 'Bitpay Quant' captured before takedown. The domain was registered on February 23, 2026, through Gname.com Pte. Ltd. and resolved to IP 104.21.35.71, hosted on Cloudflare's network (AS13335). At the time of investigation, the domain returned an HTTP 503 status, suggesting it had been taken offline or was experiencing technical issues. SSL certification was provided by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's infrastructure.

The domain appeared on three security blocklists and was actively blocked by PhishDestroy, MetaMask, and SEAL, indicating prior detection by anti-phishing vendors. Nameservers were configured to Cloudflare's standard DNS (rafe.ns.cloudflare.com and rocky.ns.cloudflare.com), and the site employed Facebook Pixel and HTTP/3 technologies, which are frequently used in both legitimate and malicious campaigns for tracking and performance optimization. No VirusTotal scan results were available at the time of analysis, meaning no vendor detections could be confirmed or ruled out based on that platform. Defenders should treat this domain as a confirmed phishing threat based on its blocklist presence and prior vendor detections.

The use of Cloudflare hosting and SSL does not indicate legitimacy, as these services are commonly abused by threat actors to obscure infrastructure. Network defenders are advised to block the domain and its associated IP (104.21.35.71) at the perimeter, and monitor for any re-activation or related domains registered through the same registrar or hosting provider. The exact phishing kit or payload delivered by this domain remains unconfirmed, and further analysis would require historical web content or telemetry data.