turtle-livechecker[.]xyz

Analysis of the domain turtle-livechecker.xyz indicates it was actively involved in an account takeover phishing campaign prior to being taken offline. The domain was registered on October 26, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 195.26.87.207, hosted on AS43641 (SOLLUTIUM EU Sp z.o.o.) in the Netherlands. Nameservers ns1-ams.v-sys.org and ns2-ams.v-sys.org were associated with the domain, which lacked an SSL certificate at the time of assessment. The page title 'Account Suspended' suggests the site may have been designed to mimic a legitimate service interruption, potentially tricking users into entering credentials to 'restore' access.

Detection data reveals the domain was flagged by six of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not disclosed. It also appeared on two security blocklists, including PhishDestroy and ScamSniffer, further corroborating its malicious classification. The domain’s infrastructure and hosting provider are consistent with patterns observed in other phishing operations, though no direct links to known threat actor groups or phishing kits have been confirmed in available intelligence. Defenders should treat this domain as a confirmed phishing threat, particularly for account takeover attempts.

Network-level blocks for the IP 195.26.87.207 and monitoring of associated nameservers (ns1-ams.v-sys.org, ns2-ams.v-sys.org) are recommended for organizations seeking to mitigate residual risk. While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. No evidence suggests this campaign targeted a specific brand, and the exact content of the phishing page remains unanalyzed. Further investigation into the registrar’s role in domain registration patterns may provide additional context for tracking similar threats.