venusprotocol[.]xyz

venusprotocol.xyz was registered on 2025-01-04 via GMO Internet, Inc. The site resolves to an IPv6 address and currently returns HTTP status code 200. The only visible metadata is the page title, which matches the domain name exactly. No further content inspection has been performed, so the precise content and any credential‑stealing mechanisms remain unknown. Technical infrastructure shows the domain resolving to 2a02:26f0:6d00:1b7::1771, a host advertised as part of AS20940, Akamai International B.V., physically located in the Netherlands. Authoritative name servers ns5.afternic.com and ns6.afternic.com serve the domain. TLS is provided by a GoDaddy.com issued certificate under the GoDaddy TLS Intermediate CA DV – R1v1, indicating a standard domain‑validated certificate without extended validation details. Threat intelligence classifies venusprotocol.xyz as a generic phishing site with a high risk rating. Eight of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears in one AlienVault OTX pulse and is listed on six independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, CryptoFirewall, and Enkrypt. The domain remains active as of the report date, July 12, 2026. Defensive actions should include immediate blocking of the IPv6 address 2a02:26f0:6d00:1b7::1771 and adding venusprotocol.xyz to URL filtering and DNS sink‑hole policies. Continuous monitoring of VirusTotal, AlienVault, and other vendor feeds is recommended to detect any change in detection ratios. Given the high risk level, low trust score, and active presence on multiple blocklists, the domain should be treated as malicious until confirmed takedown or remediation.