pornxray[.]com

This domain, pornxray.com, is currently under investigation for generic_phishing activity targeting user credentials or sensitive data. As of the latest assessment, the domain has not been confirmed as impersonating a specific brand but exhibits characteristics consistent with phishing infrastructure. Analysis remains ongoing to determine the full scope of its malicious intent. Infrastructure analysis reveals the domain was registered on June 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 157.245.130.183 and is associated with a Let's Encrypt SSL certificate (YR2). Despite appearing on one security blocklist, the domain has not been flagged by any of the 95 vendors in VirusTotal's latest scan, yielding a 0/95 detection rate. The creation date is unusually future-dated, which may indicate an attempt to evade reputation-based filtering or obfuscate its true age. The domain remains active, and its risk level is still under investigation. Organizations and users are advised to treat this domain with caution. Immediate actions include blocking the domain and its associated IP (157.245.130.183) at the network perimeter, monitoring for any connections to it in logs, and alerting security teams to its presence. End-users should avoid interacting with the domain, particularly entering credentials or downloading files. Further analysis is recommended to assess whether additional indicators of compromise (IOCs) are linked to this infrastructure.