1lli[.]xyz

Analysis indicates that the domain 1lli.xyz was registered on August 05, 2026 through the Hostinger Operations, UAB registrar. The authoritative nameservers are rene.ns.cloudflare.com and veda.ns.cloudflare.com, both belonging to Cloudflare, which points to the use of a third‑party DNS service to obscure the true hosting location. DNS resolution returns the IPv4 address 46.202.141.252; the address is not associated with a known corporate range and currently appears on a single public security blocklist.

The domain is listed by PhishDestroy as blocked and Google Safe Browsing marks it as a social‑engineering threat, confirming that at least one detection engine has observed malicious behavior. VirusTotal has recorded scans from 91 AV engines, none of which raised a detection, but the absence of detections does not constitute a safety assurance. No public SSL certificate details, HTTP response codes, page title, or content snapshots are available, leaving the exact phishing payload undefined.

Consequently, the observable indicators consist of registration metadata, Cloudflare DNS, the IP address, and the two external blocklist listings. Defenders should treat the domain as high‑risk, enforce deny‑list rules at DNS and proxy layers, and consider adding the IP to network‑level blocklists. Continuous monitoring for any change in reputation, new detections, or content exposure is recommended, as the lack of current content analysis leaves the specific phishing vector uncertain.