ensolive[.]xyz

Analysis indicates that the domain ensolive.xyz was registered on 26 October 2025 through NiceNIC International Group Co., Limited and is hosted on the IP address 195.26.87.207, which belongs to ASN 43641 (SOLLUTIUM EU Sp z.o.o.) located in the Netherlands. The authoritative nameservers are ns1-ams.v-sys.org and ns2-ams.v-sys.org. No TLS certificate is present, meaning the site can only be accessed via plain HTTP. The HTTP response currently returns a page titled “Account Suspended,” suggesting that the site has been taken offline, which is consistent with the “Current status: taken offline” observation. VirusTotal scans show that six of ninety‑five security vendors flagged the domain, providing an early indication of malicious intent.

Independent blocklist services PhishDestroy and ScamSniffer have also listed the domain, reinforcing the detection. The intelligence categorizes the activity as an “Account Takeover” scam, a form of credential‑stealing phishing that targets user accounts for unauthorized access. While the site is no longer reachable, the infrastructure artifacts remain useful for defensive controls. Security teams should ensure that the IP address 195.26.87.207 and the associated ASN are blocked at network perimeters, and that the domain name be added to corporate URL filtering and email‑gateway blocklists.

Continuous monitoring of the registrar NiceNIC and the hosting provider SOLLUTIUM EU Sp z.o.o. for any re‑registration or new sub‑domains is advisable. Because the domain lacks an SSL certificate, any future activation would be observable through clear‑text HTTP traffic, offering an additional detection vector. Defenders are advised to treat any unsolicited communications referencing ensolive.xyz as malicious and to educate end‑users about the risk of credential submission.