cxvb325d[.]christmas

Analysis indicates that the domain cxvb325d.christmas was registered through Spaceship, Inc. on July 18 2026 and is currently active. The authoritative nameservers launch1.spaceship.net and launch2.spaceship.net resolve the domain to the IPv4 address 47.242.217.10. The domain has been flagged by the PhishDestroy mitigation service and appears on a single external security blocklist, suggesting that at least one threat‑intelligence feed has identified malicious use.

VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation engines, none of which returned a detection at the time of the scan; this absence of detections does not constitute evidence of benign behavior. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP status code, or page‑title information is currently available, and no additional evidence links have been published. The limited telemetry points to a classic phishing infrastructure: a recently created domain, dedicated nameservers, and a single IP address that can be easily reassigned.

Defenders should assume that the domain is being used to host credential‑harvesting or other fraudulent pages, even though the exact content has not been observed. Recommended mitigations include adding cxvb325d.christmas to network‑level blocklists, monitoring traffic to 47.242.217.10 for anomalous patterns, and enforcing strict outbound filtering for URLs that resolve to the identified nameservers. Continuous re‑evaluation is advised, as future scans or threat‑intel feeds may provide additional indicators such as malicious payload hashes, SSL anomalies, or observed phishing landing pages.