fi-euz[.]xyz

Analysis of fi-euz.xyz, created on 20 June 2026 and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, shows multiple indicators of compromise consistent with a generic phishing operation. The domain resolves to IP address 188.114.97.3, which is hosted within AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution is serviced by the Cloudflare nameservers david.ns.cloudflare.com and elinore.ns.cloudflare.com, a configuration commonly leveraged by threat actors to hide infrastructure. The site employed a Let's Encrypt certificate (identifier YE2), providing TLS encryption without revealing additional ownership information.

Security telemetry indicates that six out of ninety‑one VirusTotal scanners flagged the domain, and the domain appears on three external blocklists. It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a phishing vector. Current HTTP status reports the domain as offline, suggesting the operators have taken the site down, either voluntarily or in response to takedown efforts.

While the page title, targeted brand, and detailed payload content remain unverified, the presence of multiple independent detections and blocklist listings provides sufficient confidence to treat the domain as malicious. Defenders should continue to block the domain at network perimeter devices, update any URL filtering or DNS sinkhole rules, and monitor the associated IP address for any re‑use. Threat intelligence feeds should be refreshed to capture any re‑registration attempts, and incident response teams should consider the domain a potential indicator of compromise for any recent user reports of credential harvesting attempts.