thismyiguanas[.]xyz

This domain was first observed on July 12, 2026 and is classified as a generic phishing site with a high risk rating. The page title returned by the web server is identical to the domain name, thismyiguanas.xyz, indicating no additional branding or content clues have been disclosed. The site is currently active and returns HTTP status code 200.

Infrastructure analysis shows the domain resolves to the IPv4 address 198.18.0.193. It was registered on August 07, 2024 through HOSTINGER operations, UAB and is delegated to the nameservers ns1.dns-expired.com and ns2.dns-expired.com. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, confirming the presence of TLS. A technology fingerprint reveals the use of Node.js, Envoy, Express, HSTS, and Akamai, suggesting a modern web stack with CDN protection. The Gridinsoft trust score for the domain is 0 out of 100, reflecting a severe lack of trust.

Threat intelligence indicates that the domain appears on three public security blocklists and is actively blocked by PhishDestroy, ScamSniffer, and Enkrypt. VirusTotal analysis shows that 2 out of 95 security vendors have flagged the domain, providing limited but notable detection. The combination of a low trust score, presence on multiple blocklists, and a high risk level underscores the malicious intent of the infrastructure.

Defenders should prioritize immediate blocking of thismyiguanas.xyz at perimeter and DNS layers, incorporate the associated IP address 198.18.0.193 into threat‑intelligence feeds, and monitor for any resolution changes. Continuous re‑scanning with multi‑vendor services is advised to capture any evolving detection signatures. Given the active status and high risk classification, organizations should also consider sinkholing traffic to mitigate potential credential harvesting attempts.