nicoil[.]xyz

On July 22, 2026, analysis of the domain nicoil.xyz indicates that it was registered on February 21, 2026 and has since been taken offline. The domain resolved to IP 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and geolocates to the United States. The TLS certificate is identified as R12, suggesting a recent or possibly self‑issued certificate. The site’s HTTP response returned a page title identical to the domain name, "nicoil.xyz". Reputation checks show a Gridinsoft trust score of 0 out of 100, placing it at the lowest confidence tier.

The domain appears on one security blocklist, specifically PhishDestroy, which flagged it as malicious. VirusTotal scans recorded 2 detections out of 93 security vendors, confirming that at least two AV engines identified it as malicious. No additional public intelligence such as OTX tags, Safe Browsing entries, or further vendor reports are present. The limited evidence points to a generic phishing infrastructure likely used for credential harvesting, though the exact target or phishing kit cannot be confirmed from the available data.

Because the domain is already offline, immediate mitigation focuses on preventing future reuse of the same hosting resources. Defenders should add the domain and its associated IP address to blocklists, monitor for re‑registration, and enforce outbound filtering for traffic to Amazon‑hosted IP ranges that have demonstrated abuse. Continuous observation of PhishDestroy, Gridinsoft, and VirusTotal updates is recommended to capture any resurgence. Uncertainty remains regarding the specific phishing campaign, the content served before takedown, and whether the certificate R12 corresponds to a legitimate CA or a mis‑issued one; further forensic capture of the site prior to shutdown would be required for deeper insight.