whisperturtledev[.]xyz

Analysis of the domain whisperturtledev.xyz indicates it is a confirmed phishing site with high-risk classification. Registered on February 21, 2026, the domain resolves to IP address 104.21.7.112, hosted on Cloudflare's infrastructure (AS13335) in the United States. As of July 23, 2026, the domain appears on five security blocklists and is flagged by 14 out of 93 security vendors on VirusTotal, including detections from PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. The domain's SSL certificate is graded WE1, a common indicator of low-security configurations often exploited by threat actors. No specific brand impersonation or phishing kit details are currently available, and the exact content of the site remains unanalyzed.

However, the combination of blocklist presence, vendor detections, and Cloudflare-hosted infrastructure strongly suggests malicious intent. Defenders should treat this domain as active phishing infrastructure until further analysis confirms otherwise. The domain is currently offline, but historical resolution and detection data warrant continued monitoring and blocking in enterprise environments.