xa600b[.]pro

Analysis as of July 23, 2026 indicates that xa600b.pro was registered on February 21, 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare’s network (AS13335) using the nameservers dale.ns.cloudflare.com and grace.ns.cloudflare.com. The domain resolves to the IP address 188.114.96.3, which is located in the United States and is owned by Cloudflare, Inc. No TLS certificate was observed, meaning the site was served over plain HTTP when it was active. The only visible page title, “XA600B Official Pre‑Sale — Get Up to 200% Bonus!”, suggests a promotional lure typical of phishing campaigns that promise exaggerated bonuses.

VirusTotal scanned the site and 13 of 93 security vendors returned a detection, confirming malicious classification. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its reputation as a phishing vector. Current DNS queries report the domain as offline, which may indicate takedown or temporary suspension, but the historical evidence remains relevant for threat‑intelligence feeds.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no sample of the hosted content has been archived. Defenders should continue to block the domain at perimeter firewalls, update URL filtering and threat‑intel feeds, and monitor the associated IP address for any future re‑hosting activity. Analysts are advised to keep the registration details and DNS records for correlation with any new campaigns that reuse the same registrar or Cloudflare infrastructure.