contentstatus-x[.]xyz

Analysis of contentstatus-x.xyz shows the domain was registered on 23 February 2026 through Atak Domain Bilgi Teknolojileri A.Ş. and uses the authoritative nameservers p1.atakdomain.com and p2.atakdomain.com. DNS resolution points to IP 185.46.40.240, which belongs to AS211401 Atak Domain Bilgi Teknolojileri A.S. in Turkey. The host presents a Sectigo Limited DV certificate issued by the Sectigo Public Server Authentication CA R36, indicating the site was served over HTTPS before being taken offline.

The page title returned by the HTTP response is “contentstatus-x.xyz | Domain Parked”, suggesting the site is currently parked rather than delivering active content. Reputation data include a Gridinsoft trust score of 0 out of 100 and detection by three independent blocklists. VirusTotal scans report three of ninety‑three vendors flagging the domain, confirming malicious intent. The domain is listed on blocklists operated by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector.

While the exact phishing lure or targeted brand is not disclosed in the available data, the combination of low trust score, multiple vendor detections, and blocklist listings indicates a high likelihood of credential‑ harvesting or fraudulent redirection. Defenders should immediately block traffic to 185.46.40.240 and add contentstatus-x.xyz to internal deny lists. Continuous monitoring of the registrar’s new registrations and of related subdomains under the same nameservers is recommended, as the infrastructure may be reused for future campaigns. The current offline status does not preclude re‑activation, so threat‑intel feeds should be updated to reflect the observed indicators.