xixpilot[.]world

This domain, xixpilot.world, is identified as a generic phishing site designed to harvest user credentials by impersonating a webmail login portal. The page title, 'Webmail :: Welcome to Webmail,' suggests an attempt to deceive users into entering sensitive account information, likely targeting corporate or personal email credentials. No specific brand affiliation or drainer kit signatures were confirmed in available intelligence, though the generic phishing framework aligns with common credential theft tactics. Analysis indicates the domain was registered on November 22, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 45.84.59.25, hosted on AS212477 (RoyaleHosting BV, Netherlands). VirusTotal detections show 15 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and lacks an SSL certificate, further reducing its legitimacy. Google Safe Browsing (GSB) status was not explicitly provided, but the domain is blocked by at least two independent threat intelligence feeds. As of the latest assessment, xixpilot.world has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially compromised via this phishing site. Network-level blocking of the IP 45.84.59.25 and domain-based filtering are recommended to prevent future exposure. Users should be alerted to verify webmail URLs and report any suspicious login prompts.