xbguard[.]xyz

Analysis of xbguard.xyz indicates an active brand impersonation campaign targeting Discord users. The domain was registered on February 21, 2026, through GoDaddy.com, LLC, and remains operational as of July 25, 2026. It resolves to IP address 172.67.174.250, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain is configured with nameservers ns15.abovedomains.com and ns16.abovedomains.com, a common setup for low-cost hosting environments.

The site returns an HTTP 200 status, signaling an active web server, and presents a page titled 'xbGuard | 17559.' While the exact content of the page is not yet analyzed, the page title and known intelligence classify this as a social media phishing operation impersonating Discord. Gridinsoft assigns a trust score of 0/100, reflecting high-risk indicators. The domain appears on at least one security blocklist (PhishDestroy) and is flagged by 5 of 93 security vendors on VirusTotal, though the specific detection rules are not disclosed. The SSL certificate is issued under the identifier WE1, which does not provide additional attribution beyond standard encryption.

Infrastructure analysis reveals no evidence of advanced evasion techniques, though Cloudflare hosting may obscure some network-level visibility. Defenders should treat this domain as a confirmed phishing resource targeting Discord credentials or related account compromise. Recommended actions include blocking the domain at DNS and web proxy layers, monitoring for connections to the associated IP (172.67.174.250), and alerting users to potential Discord-themed phishing attempts linked to this infrastructure.