xtokens[.]pro

Analysis of the domain xtokens.pro indicates that it was registered on July 20, 2026 through NameSilo, LLC and remains active as of the report date, July 23, 2026. The domain resolves to the IPv4 address 192.3.195.241, and its authoritative nameservers are not publicly disclosed. A VirusTotal scan involving 91 security vendors returned no detections, but the absence of alerts does not constitute a safety assurance.

The domain is presently listed on a single security blocklist and has been blocked by the PhishDestroy filtering service, suggesting that external threat‑intel feeds have flagged it as malicious. No public SSL/TLS certificate information, HTTP status codes, page title, or content snapshot is available, leaving the exact nature of the hosted page unverified. The combination of a newly created registration, a single blocklist entry, and the lack of transparent hosting metadata is consistent with infrastructure employed by credential‑harvesting operations that rely on short‑lived domains to evade detection.

Defenders should proactively deny traffic to xtokens.pro and its resolved IP address, incorporate the domain into existing URL filtering and DNS sink‑hole policies, and monitor for any future changes in resolution or additional blocklist placements. Continuous re‑scanning with sandbox and reputation services is recommended to capture any evolution of the site’s payload or hosting characteristics while the risk level remains under investigation.