mxilab.info was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on July 25 2026 and remains active as of the report date, July 28 2026. The domain is delegated to Cloudflare nameservers jack.ns.cloudflare.com and laylah.ns.cloudflare.com, and resolves to the IP address 104.21.81.172, which is part of Cloudflare’s global edge network. The domain appears on a single security blocklist and has been flagged by the PhishDestroy feed, indicating that at least one downstream security product has identified it as malicious.
A VirusTotal scan submitted the domain to 91 antivirus and URL‑reputation engines; none of the engines reported a detection at the time of analysis, but the absence of detections does not constitute evidence of benign behavior. No additional public intelligence such as Google Safe Browsing, OTX, SSL certificate details, HTTP response codes, or page title information is currently available. Consequently, the precise content hosted at the domain cannot be confirmed, and the specific phishing lure remains uncharacterized beyond the generic classification supplied.
Defenders should continue to block the domain at network and endpoint layers, incorporate the observed IP address into threat‑intel feeds, and monitor for any future changes in the domain’s reputation or hosting characteristics. Ongoing re‑scans with multi‑engine services and periodic checks of blocklist status are recommended to detect potential evolution of the threat.