koix[.]xyz

The domain koix.xyz is currently active and resolves to the IPv4 address 93.89.226.17, which is assigned to the Turkish autonomous system AS51557 operated by Isimtescil Bilisim A.S. The registration was performed by Isimtescil Bilisim A.S. on 19 September 2025 and the zone uses the nameservers eu.dnsenable.com, tr.dnsenable.com and us.dnsenable.com. No TLS certificate is presented, and HTTP requests return a 200 status code. The site’s page title reports “isimtescil.net | Türkiye'nin Domain ve Hosting Lideri | Hoş geldiniz,” indicating the page is likely a generic hosting‑provider landing page rather than a legitimate Google service. Threat intelligence flags the domain as a high‑risk brand‑impersonation campaign targeting Google, employing a tech‑support scam narrative. VirusTotal records show that 17 of 95 scanners have flagged the domain, and AlienVault OTX lists it in 50 threat pulses. The domain appears on three public blocklists (PhishDestroy, PhishingDB, BLP‑Malware) and receives a Gridinsoft trust score of 0 / 100. Given the observed infrastructure, the lack of encryption, and the multiple detections, security operators should block both the domain and its resolved IP, monitor for DNS queries to the listed nameservers, and consider adding the indicator set to internal blocklists. Further content analysis is required to confirm the exact phishing page layout, but existing evidence is sufficient to treat koix.xyz as a confirmed malicious actor.