xenologic[.]pro

On 25 July 2026, the domain xenologic.pro was observed being served as a generic phishing site. The site returned HTTP status indicating it is currently taken offline, and its page title was recorded as “Success!”. The domain was registered on 21 February 2026 through Unstoppable Domains Inc, a blockchain‑based registrar that often supplies .crypto‑style domains. DNS resolution points to the IPv4 address 45.9.148.51, which belongs to AS49447 Nice IT Services Group Inc. and is geolocated in the Netherlands. The host presents an SSL certificate issued to “Hestia Control Panel / 8102be99.as49447.net”, confirming the use of a control‑panel generated certificate rather than a public‑trusted CA.

Reputation services show that xenologic.pro is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of confidence. VirusTotal analysis returned 14 positive detections out of 93 scanning engines, reflecting a moderate consensus among anti‑malware vendors that the domain is malicious. The domain’s nameservers are Google Cloud DNS endpoints (ns‑cloud‑d1.googledomains.com, ns‑cloud‑d2.googledomains.com, ns‑cloud‑d3...), suggesting that the infrastructure is hosted on Google Cloud Platform. The evidence points to a short‑lived phishing infrastructure that was deployed shortly after registration and taken down within a few months.

The exact phishing campaign details, such as targeted brands or credential‑harvesting pages, have not been disclosed; the only visible artifact is the generic “Success!” title, which may be used to signal a successful credential capture to the attacker. Because the site is already offline, immediate containment is not required, but the IP address and associated ASN should be added to internal blocklists and monitored for reuse.