xeno-courier[.]com

Analysis of the domain xeno-courier.com, first observed on a security blocklist, indicates active malicious infrastructure targeting users through phishing techniques. The domain was registered on April 10, 2025 via the registrar TuringSign Inc. doing business as Cosmotown. It is authoritative for four name servers: ns1.controlpanel.sbs, ns2.controlpanel.sbs, ns1.globaldnsnetwork.com, and ns2.globaldns, suggesting a multi‑provider DNS setup that can facilitate rapid re‑hosting. DNS resolution points to the IPv4 address 163.61.188.108, which remains reachable as of the report date, confirming that the site is still operational. VirusTotal records show that the domain has been scanned by 91 antivirus and URL scanning engines, none of which have issued a detection at the time of analysis.

Although the absence of detections does not imply safety, the lack of any positive verdict aligns with the observed pattern of low‑profile phishing deployments that avoid triggering automated signatures. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy sink‑hole, providing some defensive visibility. Current intelligence does not include a publicly visible page title, SSL certificate details, or HTTP response codes, leaving the exact content of the landing page unverified. Consequently, analysts cannot confirm the specific credential‑harvesting mechanisms or the target brand, if any.

The classification remains “generic phishing” based on the threat type field supplied. Defenders should add the domain and its associated IP address to inbound and outbound filtering rules, enforce DNS‑based blocklists that include the identified entry, and monitor the four name servers for rapid redeployment. Continuous re‑scanning on platforms such as VirusTotal is recommended to capture any future classification changes. Organizations using URL filtering should consider adding xeno-courier.