compound[.]xyz

Analysis of www.compound.xyz indicates that the domain is currently listed on a single public blocklist and is actively blocked by the PhishDestroy service. DNS resolution points to the IP address 104.26.0.125, which is hosted on Cloudflare infrastructure as evidenced by the authoritative nameservers brit.ns.cloudflare.com and tim.ns.cloudflare.com. The domain was originally registered on 25 September 2019 through Namecheap Inc., and no recent registration activity has been observed. VirusTotal has recorded detections from two of ninety‑one scanned scanners, confirming that at least a minority of security engines consider the site malicious.

The limited detection count and the presence on only one blocklist suggest that the phishing infrastructure may be low‑volume or newly re‑activated, but the continued active status warrants caution. No public information about the site’s HTTP response, SSL certificate details, page title, or targeted brand has been disclosed, so the exact phishing lure remains unknown. The lack of additional intelligence prevents attribution of a specific campaign or malware kit.

Defenders should therefore treat www.compound.xyz as a high‑risk indicator. Recommended actions include adding the domain to outbound filtering rules, monitoring DNS queries for resolutions to 104.26.0.125, and ensuring that any user‑initiated connections to the domain are blocked or flagged for further investigation. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status.