dm[.]xxicantxx[.]cyou

The domain dm.xxicantxx.cyou, a phishing site, is already offline but was flagged by two vendors on VirusTotal as malicious. It was hosted on Cloudflare's network with the IP address 104.21.77.102, located in the United States. The site used an SSL certificate issued by Google Trust Services, indicating a potentially sophisticated setup to deceive users.

PhishDestroy identified this threat on February 3, 2026, ahead of its official domain creation date of February 21, 2026. This early detection highlights PhishDestroy's capability to spot phishing domains during the critical pre-detection window, often before they appear in antivirus databases. The domain was listed on one public blocklist, specifically PhishDestroy's.

Although the site is currently offline, its initial presence and quick takedown suggest a rapid deployment strategy, typical of phishing operations aiming to exploit short-lived opportunities. The use of a Cloudflare-hosted IP and a legitimate SSL issuer might have been intended to lend the site an appearance of credibility, increasing the likelihood of successful phishing attempts. This case underscores the importance of early threat detection and the dynamic nature of phishing schemes.