dxbprivatemodels[.]com

The domain dxbprivatemodels.com was registered on March 11 2026 through NiceNIC International Group Co., Limited. It immediately began serving a page titled “Kassandra - Sensational Blonde Escort in Dubai”, a classic lure that mimics legitimate escort listings to entice victims. The site is classified as a brand‑impersonation campaign targeting the across brand, and its advertised content is paired with a cryptocurrency payment demand, indicating a financial fraud vector.

Technical resolution shows the domain pointing to IP address 104.21.88.30, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. DNS is hosted on collins.ns.cloudflare.com and leif.ns.cloudflare.com. The web server presents an SSL certificate rated E7 and enforces HSTS, while also advertising HTTP/3 and Cloudflare Browser Insights. An HTTP 200 response is returned for the front page, confirming active content delivery.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and three of ninety‑five VirusTotal scanners flagging the domain. The site is presently listed on one public blocklist and has been blocked by the PhishDestroy service. Although the exact malicious payload has not been captured, the combination of brand impersonation, escort‑style luring, and cryptocurrency payment requests aligns with known high‑risk fraud patterns, justifying its high‑risk status.

Defenders should add dxbprivatemodels.com to blocklists at DNS and proxy layers, monitor outbound connections to the associated IP, and consider sinkholing the domain to disrupt further victim acquisition. Continuous threat‑intel feeds should be checked for any emerging indicators tied to this infrastructure, and users should be warned about unsolicited escort offers that demand cryptocurrency payments.