gizagroup[.]xyz

On 22 July 2026, investigators observed that the domain gizagroup.xyz was registered on 21 February 2026 and subsequently resolved to the IP address 104.21.112.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the HTTP response title “Just a moment…”, and its SSL certificate is identified as “WE1”. VirusTotal recorded a single positive detection out of 93 scanning engines, indicating at least one vendor flagged the domain as malicious.

The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service. As of the report date the hosting was taken offline, and no active content was reachable. Current intelligence does not reveal the specific phishing kit, targeted brand, or payload details, and no additional HTTP or DNS observations have been published.

Defenders should add gizagroup.xyz to deny lists, monitor the associated IP 104.21.112.1 for any resurgence of activity, and continue to query threat‑intelligence feeds for updates. Ongoing surveillance of Cloudflare‑served IP ranges is advised, as the provider is frequently abused for fast‑flux and hide‑behind techniques. The limited detection footprint suggests a low‑profile campaign, but the presence of a vendor flag and blocklist entry warrants elevated caution.