peacememe[.]xyz

The domain peacememe.xyz was registered on March 4 2026 through GMO Internet Group, Inc. d/b/a Onamae.com. It is presently active and serves HTTP responses with status 200. The site presents the page title “peacememe.xyz” and is classified as a generic phishing threat with a high risk rating. Its SSL certificate is issued by Go Daddy Secure Certificate Authority – G2, indicating a legitimate‑looking TLS layer.

Infrastructure analysis shows the domain resolves to the IPv6 address 2a02:26f0:480:5a6::1771, which maps to an Akamai International B.V. network (AS20940) located in Germany. The authoritative name servers are ns5.afternic.com, ns6.afternic.com, and a verification sub‑domain, suggesting the use of a third‑party DNS hosting service. The web stack is identified as Node.js running behind Envoy and Express, with HTTP Strict Transport Security enabled and Akamai edge caching in place.

Reputation data indicate the domain is flagged by 2 of 95 security vendors on VirusTotal, appears on a single public blocklist, and has received a Gridinsoft trust score of 0 / 100. The site is also listed as blocked by PhishDestroy, confirming active mitigation by at least one anti‑phishing community. No MX records are configured, which is typical for domains used solely for hosting malicious landing pages.

Defenders should prioritize blocking both the domain and its associated IPv6 address at network perimeters. Continuous monitoring of DNS queries for the listed name servers can provide early warning of replication attempts. Given the low trust score and existing blocklist entries, security solutions should incorporate peacememe.xyz into URL filtering rules and consider heuristic detection for the observed Node.js/Envoy stack. Incident response teams should also examine inbound traffic logs for attempts to contact the Akamai‑served IP range to identify potential victimization.