ai-xyzverse[.]xyz

On July 25, 2026 the domain ai-xyzverse.xyz was observed to host a generic phishing page. The site returned the title “Just a moment…”, which provides no indication of the targeted brand or credential‑capture technique. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Cloudflare services are confirmed by the presence of Cloudflare Browser Insights, HTTP/3 support, and the authoritative nameservers aryanna.ns.cloudflare.com and malcolm.ns.cloudflare.com.

The TLS certificate is issued by Google Trust Services under the WE1 trust anchor, indicating a valid HTTPS configuration. VirusTotal scanned the domain and 3 of 93 security vendors reported it as malicious, reinforcing the suspicion raised by the PhishDestroy blocklist, where the domain appears as a single listed entry. No additional public blocklists, Safe Browsing, or OTX references were found in the current intelligence set.

The site was taken offline at the time of analysis, and no further page content was captured. Because the page title and infrastructure provide limited insight into the phishing lure, defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑activation of the host, and watch for related Cloudflare‑hosted IP ranges that may be reused by the same threat actor. Ongoing correlation with other Cloudflare‑protected domains and periodic re‑scans on VirusTotal are recommended to capture any changes in the detection profile.