zknight[.]xyz

Analysis of zknight.xyz conducted on July 25 2026 indicates that the domain is presently taken offline. The domain was registered on March 22 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. DNS queries return the Cloudflare authoritative name servers garrett.ns.cloudflare.com and grannbo.ns.cloudflare.com, and the site is served over HTTPS using a Let’s Encrypt certificate. HTTP traffic is observed to be delivered via Cloudflare’s HTTP/3 implementation. The only HTTP response captured is the title “404 Not Found”, suggesting that no phishing landing page is currently hosted.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting the HTX brand. The classification is corroborated by three independent blocklists that have listed the domain, and by three of ninety‑four security engines on VirusTotal marking it as malicious. Additional protective services, including PhishDestroy, MetaMask, and SEAL, have also blocked the domain. No public Safe Browsing or OTX entries were identified for this host. Defenders encountering traffic to zknight.xyz should treat the domain as malicious despite its offline status, because the infrastructure—Cloudflare IP, TLS certificate, and known blocklist listings—matches typical phishing operations.

Network controls should continue to deny or sandbox connections to the IP 188.114.97.3 and to the domain name. Monitoring of DNS queries for the associated Cloudflare name servers can help detect future re‑use of the same hosting environment. Because the domain is newly created (less than four months old) and already appears on multiple blocklists, any resurgence should be considered high priority for incident response. Continuous review of blocklist updates and VirusTotal scans is recommended to capture any new detections.