enosysnetwork[.]xyz

Enosysnetwork.xyz was observed hosting a brand‑impersonation campaign targeting the generic “across” brand. The domain was registered on 14 October 2025 through Web Commerce Communications Limited and delegated to the LuxHost name servers hold1.luxhost.org and hold2.luxhost.org. DNS resolution points to the IPv6 address 2606:4700:3035::ac43:96b5, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was presented when the site was queried, indicating that the service was operating without HTTPS. The page title returned by the server is “Ēnosys”, which does not match the advertised brand and provides no additional context about the malicious payload.

The infrastructure received a trust score of 0 / 100 from Gridinsoft and was flagged by seven of ninety‑five VirusTotal scanners that examined the domain. PhishDestroy has listed the domain on its blocklist, and the domain appears on a single external security blocklist. AlienVault OTX recorded the domain in one threat‑intel pulse, confirming its presence in at least one community‑shared indicator set. The domain is currently taken offline, which stops active HTTP responses but leaves the underlying infrastructure intact. Analysts can confirm the registration details, name‑server configuration, IP hosting, and the limited detection coverage, but they lack visibility into the exact content served, the credential‑collection mechanism, or any payload delivered to victims.

Because the site is hosted behind Cloudflare, attribution to a specific operator is obscured, and the lack of an SSL certificate suggests a hastily assembled phishing kit rather than a more sophisticated campaign. Defenders should add enosysnetwork.xyz to URL filtering and DNS‑blocking rules, monitor Cloudflare‑owned address ranges for related activity, and ingest the OTX pulse and PhishDestroy indicator into their threat‑intel platforms.