contract-whop[.]xyz

contract-whop.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers leonard.ns.cloudflare.com and novalee.ns.cloudflare.com indicate that the domain was hosted behind Cloudflare’s network. DNS resolution points to IP address 172.67.177.159, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The TLS certificate presented by the service is issued by Google Trust Services under the WE1 intermediate, confirming the use of Cloudflare’s SSL termination.

At the time of collection the site returned an HTTP response with the page title “Just a moment…”, a common placeholder used by Cloudflare when a challenge page is presented. No further content was captured, and the domain is currently listed as offline. VirusTotal scans recorded five positive detections out of ninety‑three submitted engines, and the domain appears on a single external blocklist, specifically PhishDestroy, which has already taken the site offline. No additional public threat‑intel feeds such as OTX or Google Safe Browsing are referenced in the available data.

The observable indicators suggest that contract‑whop.xyz was deployed as a generic phishing landing page, likely intended to redirect or display a Cloudflare challenge before delivering malicious payloads or credential‑harvesting forms. Because the infrastructure relies on shared Cloudflare IP space, direct attribution to a specific actor is limited, but the rapid takedown by a dedicated blocklist demonstrates that the domain was identified as abusive shortly after deployment. Defenders should continue to block the domain at DNS and proxy layers, incorporate the IP address 172.67.177.159 into threat‑intel feeds with a note on shared hosting, and monitor any future registrations that reuse the same nameservers or SSL configuration.