aarnaai[.]xyz

Analysis indicates that aarnaai.xyz is an active generic phishing infrastructure first observed in May 2026. DNS resolution points to IP 188.114.96.3, which is hosted in Canada and associated with a major content delivery network. The domain is delegated to the nameservers earl.ns.cloudflare.com and laura.ns.cloudflare.com and presents a TLS certificate issued by Let’s Encrypt, confirming HTTPS availability. HTTP requests return a 403 status with the page title “Bot Verification”, suggesting the site employs automated challenge mechanisms. Detected technologies include a CAPTCHA service, browser insight scripts, and HTTP/3 support, all typical of sites attempting to evade automated analysis. The domain appears on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans report three positive detections out of ninety‑one AV engines, and AlienVault OTX references the domain in one pulse. Registration data shows the registrar as NICENIC INTERNATIONAL GROUP CO., LIMITED, with the domain created on 03 May 2026. The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. Current intelligence does not reveal the specific credential‑harvesting page or target brand beyond the generic title. Defenders should block the domain and its associated IP at perimeter and endpoint controls, monitor DNS queries for the domain and its nameservers, and consider adding the host to internal blocklists. Ongoing observation is advised to detect any evolution of the payload or redirection behavior.