lto-eqtymig[.]xyz

Analysis of lto-eqtymig.xyz indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335) with the IP address 104.21.13.11 located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. HTTP responses include HSTS and the site utilizes Cloudflare Browser Insights and HTTP/3, confirming that the infrastructure is fully managed by Cloudflare. The page title returned by the server is “Just a moment…”, and the domain has been taken offline at the time of this assessment.

Threat intelligence sources have classified the domain as a generic phishing site. It appears on one security blocklist, specifically PhishDestroy, and six of ninety‑three VirusTotal scanners have flagged it as malicious. No additional public Safe Browsing or Open Threat Exchange records are present. The limited evidence suggests that the domain was likely used to host a phishing landing page before being taken down.

Defenders should add lto-eqtymig.xyz to URL filtering and web‑proxy block lists, monitor DNS queries for the resolved IP 104.21.13.11, and enforce TLS inspection to confirm that any future redeployments continue to present the same certificate chain. Because the hosting provider is Cloudflare, any rapid re‑registration or reuse of the same IP range should trigger alerts. Continuous observation of the registrar NiceNIC for new registrations with similar naming patterns is also recommended. While the current offline status limits immediate impact, the presence on a known blocklist and multiple vendor detections warrants elevated vigilance.