Researcher flags XServer phishing sites on secure-xdomain-*.w-group.shop subdomains
@masaomi346 listed five phishing sites on 1 November 2026, such as secure-xdomain-55493.w-group.shop, that imitate Japanese hosting service XServer. XServer is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese security researcher @masaomi346 posted on X on 1 November 2026 a list of phishing sites impersonating XServer, a Japanese web-hosting and domain service. The sites, shown in defanged form in the post, are secure-xdomain-55493.w-group.shop, secure-xdomain-69342.w-group.shop, secure-xdomain-71481.w-group.shop, secure-xdomain-88755.w-group.shop and secure-xdomain-92411.w-group.shop. The post is tagged #Phishing and #フィッシング詐欺 (phishing fraud). XServer is not involved: none of these is an XServer address. On 1 November 2026 scammers.com also found another subdomain following the same pattern, secure-xdomain-74372.w-group.shop, on Phishing Army's extended blocklist.
How the scam works
The screenshots in the post show one of the pages opened on a phone. It carries the XServer rental-server logo, a heading that reads “Security verification” (セキュリティ検証), the line “To continue, please complete verification” and a Cloudflare-style “I am not a robot” box. The address bar shows a domain ending in w-group.shop. A fake checkpoint like this makes a page look careful and professional, and it can also stop some automated scanners from seeing what is behind it. The researcher's post does not show the later steps, but XServer-themed phishing pages normally lead to a sign-in form that captures the customer's login details, which can then be used to take over hosting accounts, domains and email.
The naming is a pattern. Each address begins with “secure-xdomain-” and a five-digit number, then the same w-group.shop domain, which suggests the operators create many throwaway subdomains so that the blocking of one does not end the campaign. Lists of this kind help security teams and filter vendors block the whole group.
XServer customers should reach their account only through the address they know and not through links in emails or messages, and should be careful with any email about domain renewals, server suspension or unpaid fees.
Source
@masaomi346 on X, post of 1 November 2026 (list of sites and screenshots), with a blocklist check by scammers.com the same day. Not independently verified.
Red flags
- A page using the XServer logo on a domain ending in w-group.shop.
- Subdomains with a repeated pattern, such as secure-xdomain- followed by a five-digit number.
- A “security verification” step with a fake robot check before any sign-in form appears.
- An email or message urging you to log in to hosting, domain or server services through a link.
- A request for hosting or domain account credentials on a page you did not reach by typing the official address.
If you were targeted
- 1Do not enter any login details on a secure-xdomain-*.w-group.shop page.
- 2If you did, change your XServer password at once through the official XServer site and enable two-step verification if available.
- 3Check your domains, server settings and email forwarding for changes you did not make.
- 4Log in to XServer only by typing the address yourself or using a bookmark.
- 5Report the phishing message to XServer through its official support channels.