xaidov[.]com

Analysis of xaidov.com shows the domain is actively hosted behind Cloudflare (eric.ns.cloudflare.com, vita.ns.cloudflare.com) and resolves to IP 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is protected by a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake. Cloudflare Browser Insights and HTTP/3 support are detected, suggesting the operator is leveraging modern CDN features. The HTTP response code returned is 521, which Cloudflare uses to indicate that the origin server is refusing connections; this is consistent with a temporary takedown or misconfiguration often observed in malicious phishing infrastructure.

VirusTotal scans have flagged the domain in 14 of 93 security vendors, and the domain is listed on a single public blocklist. It is also blocked by the PhishDestroy service, confirming that multiple independent threat feeds consider it malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation. The page title returned from the site is simply “xaidov.com”, providing no additional context about the intended lure.

Based on the available evidence, the domain is classified as a high‑risk generic phishing site. Defenders should block DNS resolution for xaidov.com at the network perimeter, add the IP address 188.114.97.3 to any host‑based deny lists, and ensure that web filtering solutions reference the current blocklist entry. Continuous monitoring of the domain’s status is advised, as the 521 response may change if the underlying phishing page becomes reachable again. Organizations should also consider sharing the indicator set with threat‑intelligence sharing platforms to improve collective detection.