xa67p[.]xyz

On July 24, 2026 analysts examined the domain xa67p.xyz, which is categorized as a generic phishing site and currently listed as offline. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolved to the IP address 104.21.12.31, an address associated with Cloudflare, Inc. (AS13335) located in the United States. No SSL certificate was observed for the site, indicating that traffic was not encrypted. The page title retrieved before takedown read “XA67P Pre‑Sale Is Live Secure Up to 200% Bonus Now!”, suggesting a fraudulent investment‑oriented lure.

The domain appears on one public security blocklist and has been blocked by the PhishDestroy filtering service. VirusTotal scans reported 12 detections out of 93 contributing security vendors, confirming that a notable subset of anti‑malware engines flagged the domain as malicious. Nameserver records list josephine.ns.cloudflare.com and stan.ns.cloudflare.com, reinforcing Cloudflare as the DNS provider.

While the page content has not been publicly archived, the available metadata indicates a short‑lived infrastructure designed to exploit interest in high‑return investment offers. Defenders should add xa67p.xyz to blocklists, enforce DNS‑level denial for the domain and its associated IP, and monitor Cloudflare‑originating traffic for similar patterns. Continuous validation against emerging blocklists and re‑assessment of the IP reputation are recommended to mitigate residual risk from any residual infrastructure that may be repurposed.