whalegurusol[.]xyz

The domain whalegurusol.xyz was registered on May 08, 2026 through PublicDomainRegistry.com (PDR Ltd.) and is currently hosted behind Cloudflare’s network in Canada. DNS resolution points to IP 188.114.97.3, which is owned by Cloudflare, Inc. The authoritative name servers are leo.ns.cloudflare.com and phoenix.ns.cloudflare.com, and the site presents a Google Trust Services (WE1) SSL certificate, indicating a valid TLS handshake.

Threat intelligence feeds have flagged the domain as a high‑risk credential‑harvesting site. VirusTotal records show that 3 of 95 scanned security vendors have issued detections, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in sixteen separate pulses, reinforcing its reputation as a recurring malicious indicator.

Active probing of the HTTP endpoint returns a 403 status code, suggesting that the front‑end may be deliberately restricting access to automated scanners while presenting a legitimate‑looking login page to targeted users. The combination of a recent registration date, Cloudflare front‑end, and a trusted SSL certificate is typical of fast‑flux or “look‑alike” campaigns that aim to evade reputation systems. No additional infrastructure, such as associated command‑and‑control servers or malware payload hashes, has been publicly disclosed, leaving the precise phishing template and target audience uncertain.

Defenders should block whalegurusol.xyz at the DNS or proxy level, and monitor outbound connections to 188.114.97.3 for anomalous credential submission patterns. Email security gateways should be updated to flag any messages containing URLs or brand references that resolve to this domain. Continuous re‑scanning with multi‑engine services is advised, as the low vendor detection count may increase as the campaign matures.