tkresearch[.]xyz

Analysis indicates that the domain tkresearch.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare address 188.114.97.3, originating from the United States under ASN 13335. The domain leverages Cloudflare services, as evidenced by the authoritative nameservers earl.ns.cloudflare.com and laura.ns.cloudflare.com, and presents HTTP/3 support along with Cloudflare Browser Insights. Hosting appears to be provided by Hostinger, although the public IP belongs to Cloudflare’s edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid, publicly trusted certificate chain.

VirusTotal scans have recorded seven positive detections out of ninety‑three vendor analyses, and the domain has been placed on a single external blocklist. Independent telemetry from PhishDestroy confirms that the site has been taken offline as of the report date. Additional reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating a high‑confidence malicious classification. The only observable content is the page title “HolyVerse: Season 2 – The Expansion,” which does not directly reveal the phishing payload but aligns with the generic phishing classification assigned to the campaign.

No further page content has been captured, leaving the specific luring technique and target audience uncertain. Defenders should block the domain at the DNS layer, enforce TLS inspection to capture any pending payload, and monitor for any future re‑registration or replica infrastructure that might reuse the same IP or hosting provider. Ongoing observation of the listed blocklist and continued VirusTotal re‑scans are recommended to capture any evolution of the indicator set.