xoxlabs[.]xyz

PhishDestroy identifies xoxlabs.xyz as a credential-phishing landing page designed to steal login details under the guise of a fake lab service. The site prompts visitors to enter usernames and passwords directly into a lookalike interface, then exfiltrates the data to attacker-controlled servers. This domain was flagged on February 13, 2026, the same day it was created, and is already hosted on IP 104.21.81.49 using a TLS certificate issued by Google Trust Services. VirusTotal currently shows 0 detections out of 95 engines, placing it in the earliest stages of discovery. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, a provider that has previously enabled bullet-proof hosting for short-lived malicious domains. If you visited xoxlabs.xyz, assume your credentials may have been exposed. Immediately change any reused passwords, enable multi-factor authentication on all critical accounts, and scan your devices for malware. Report the domain to your IT team or security provider and block 104.21.81.49 at your firewall. Monitor financial and email accounts for suspicious activity over the next 30 days.