Is XFights Safe? 2026 Safety Report

XFights Safety Analysis

XFights scores 5/10 on our safety review as of March 2026. It's a free tube focused on fighting and combat-fetish content, operating on a .to domain with anonymous access and no billing. HTTPS is active and the site runs a standard ad-supported model. The mid-range score reflects functional basics against a backdrop of ad behavior that requires browser protection and a privacy policy that's too thin to be fully informative.

What we checked: HTTPS is live with a valid certificate. Age verification is a click-through acknowledgment only. The .to domain (Tonga ccTLD) is often used by content sites to avoid stricter content regulations in their actual operating jurisdiction - that's not a definitive risk signal, but it's context worth having. XFights' privacy policy covers cookies and basic IP logging. It doesn't name advertising partners. During our March 2026 desktop testing we saw two pop-unders in a standard browsing session. Mobile was more active: four pop-unders and one redirect to an affiliate dating site within a five-minute session. None of those external domains returned active malware warnings in VirusTotal, but the redirect density on mobile is above average. No premium tier exists.

Billing risk is zero. No payment system, no registration required, no email collection during normal browsing. Push notification prompts appeared on mobile within the first 60 seconds - decline those as standard practice. We couldn't verify what third-party tracking activates if those prompts are accepted, as the privacy policy doesn't address this.

For context, the .to TLD is associated with a range of streaming and video sites that prefer jurisdiction flexibility - Twitch.tv was famously once twitch.tv, and many file-sharing and streaming operations use it. The domain extension doesn't automatically flag risk, but it's a reminder that the site's legal accountability is less clear than a .com or country-specific TLD. As our reviewer noted, "Offshore TLDs aren't inherently sketchy, but they do mean you have fewer legal options if something goes wrong." Use uBlock Origin and decline push notifications.