cassandran[.]xyz

Analysis as of July 29 2026 indicates that the newly registered domain cassandran.xyz is actively being used for generic phishing. The domain was created on July 28 2026 and is registered through Namecheap Inc. Authoritative name servers are dns1.registrar-servers.com and dns2.registrar-servers.com, and DNS resolution points to the IPv4 address 199.190.45.170. VirusTotal scans have returned detections from nine of ninety‑one security vendors, confirming malicious behavior. The domain appears on a single external blocklist and is specifically listed as blocked by the PhishDestroy service.

No additional public indicators such as Safe Browsing warnings, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or page title information have been published at this time. Consequently, the full scope of the phishing campaign—including the targeted brand, lure content, and command‑and‑control infrastructure—remains unknown. Given the high risk rating and active status, defenders should immediately add cassandran.xyz and its resolving IP 199.190.45.170 to network deny lists. Monitoring of DNS queries for the two registrar‑provided name servers can provide early warning of potential re‑use.

Continuous re‑scanning on multi‑vendor platforms such as VirusTotal is advised to capture any changes in detection coverage. Organizations employing web filtering should ensure that the domain is blocked in both URL filtering and email security gateways. Because the domain is only one day old, rapid takedown requests to the registrar and hosting provider may be effective. Ongoing intelligence collection should focus on obtaining the site’s HTTP response headers, TLS certificate fingerprint, and any observed phishing lure content to refine mitigation actions.