larpghost[.]xyz

The domain larpghost.xyz is currently active and classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. and located in Canada. The authoritative nameservers are aaden.ns.cloudflare.com and dora.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. Registration records list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar. The site presents an HTTP 308 status code and serves a Google Trust Services / WE1 SSL certificate, yet the page title reports a “525: SSL handshake failed” error, suggesting intentional disruption of secure connections. VirusTotal scans have flagged the domain by four of ninety‑one security vendors, and it appears on at least one public blocklist. The domain is also listed by the PhishDestroy blocklist. While the specific brand or credential‑harvesting page content has not been disclosed, the presence of a valid SSL certificate combined with a handshake failure may be used to lure users into trusting the site before redirecting to a malicious payload. Defenders should block DNS resolution for larpghost.xyz, add the IP 188.114.97.3 to network deny lists, and monitor for any traffic to the associated Cloudflare nameservers. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or target vector.