r40x[.]xyz

This domain, r40x.xyz, was registered through Gname.com Pte. Ltd. on 21 February 2026 and is currently taken offline. The authoritative name servers listed are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com and ns2.dnsbm.com, indicating use of multiple third‑party DNS providers. DNS resolution points to the single IPv4 address 45.196.247.179, which is announced by AS140224 belonging to Nebula Global LLC and geolocated in Hong Kong. No TLS certificate is presented for the host, and an HTTP request returns the generic page title “Server Not Found”, suggesting the web service is intentionally unavailable or has been removed.

VirusTotal reports that 16 of 95 scanned security vendors flag the domain, demonstrating a modest level of detection across the ecosystem. The same indicator appears in one AlienVault OTX pulse and is listed on a single external blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain is actively blocked by the PhishDestroy sinkhole, reinforcing the classification as a phishing‑related infrastructure. The available evidence confirms that r40x.xyz was used for a generic phishing campaign, but the exact payload, target brand, or compromised credentials have not been disclosed.

Because the site is offline, real‑time traffic analysis is limited, and the absence of an SSL certificate prevents inspection of encrypted payloads. Defenders should continue to block the IP address 45.196.247.179 at network perimeters, add the domain to DNS‑based deny lists, and monitor for any resurgence of the associated name servers or ASN. Correlation with the 16 VirusTotal detections and the OTX pulse can aid threat‑intel enrichment. Ongoing vigilance is advised, particularly for email gateways and web proxies that may still reference the domain in historical phishing templates.