xenforo[.]biz

This domain, xenforo.biz, is flagged as a high-risk generic phishing threat that remains active as of this report. Registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada. The domain uses nameservers randall.ns.cloudflare.com and wanda.ns.cloudflare.com, and its SSL certificate is issued by Google Trust Services / WE1. Analysis shows the domain returns an HTTP 403 status and presents a page title of 'Just a moment...', suggesting a Cloudflare challenge or access control page that may obscure the underlying phishing content. The domain appears on 1 security blocklist and is blocked by PhishDestroy. AlienVault OTX lists this domain in 8 threat intelligence pulses, and VirusTotal reports 1 of 94 security vendors flagging it. The Gridinsoft trust score is 0/100. Defenders should treat this domain as actively malicious, block it at the network and email gateway levels, and monitor for any associated subdomains or related IPs. The exact brand or service being impersonated is not yet identified from the available data, so further investigation of the hosted content is recommended to determine the specific phishing lure. Given the domain's creation in March 2026 and its presence in multiple threat intelligence sources, it is likely part of a broader phishing campaign. Defenders should also review any email or web traffic logs for connections to this domain and consider adding it to threat intelligence feeds for ongoing monitoring.