xyzverse[.]io

Analysis of the domain xyzverse.io indicates active phishing infrastructure targeting users of an unspecified XYZ-branded service. The domain was registered on February 21, 2026, through TLD Registrar Solutions Ltd., a registrar frequently associated with abusive registrations. It currently resolves to the IP address 216.150.16.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain is configured with MX records pointing to itself, suggesting potential use for credential harvesting via email-based lures, though no specific phishing kit or campaign type has been confirmed. Technical indicators reveal the use of Proton Mail, Node.js, React, Vercel, and Next.js, which are consistent with modern phishing frameworks designed to evade detection and mimic legitimate web applications. The presence of Google Tag Manager and Twitter Ads may indicate attempts to drive traffic through malvertising or social engineering. The domain enforces HSTS, a security feature that, while typically associated with legitimate sites, can also be leveraged by threat actors to lend credibility to fraudulent pages. Detection data remains limited but concerning. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 93 vendors in VirusTotal scans. AlienVault OTX records one threat intelligence pulse referencing this domain, further corroborating its malicious classification. The SSL certificate, issued by Let’s Encrypt (R12), provides encryption but does not validate the legitimacy of the site. Nameservers are hosted under icedns.is, a provider with a history of hosting abusive domains. Defenders should prioritize blocking this domain at the DNS and network levels, particularly given its active status and high-risk classification.