onionurl[.]xyz

The domain onionurl.xyz was registered through NameSilo, LLC on August 31, 2021. Since its creation it has been listed on a single security blocklist and is actively blocked by the PhishDestroy feed, which contributes to its elevated risk rating. VirusTotal scans indicate that five of ninety‑one security vendors have generated detections for the domain, confirming that a portion of the scanning ecosystem recognizes malicious activity.

The threat type assigned is generic phishing, but no publicly available details on the landing page, page title, or credential‑harvesting mechanism have been disclosed. Open‑source intelligence currently lacks information on the hosting provider, IP address, autonomous system number, TLS certificate, HTTP status codes, or Safe Browsing and OTX entries, leaving the underlying infrastructure uncertain. Defenders should treat onionurl.xyz as hostile: add it to URL filtering and DNS sinkhole policies, ensure that web proxies and email gateways block outbound connections, and propagate the blocklist entry across internal security tools.

Continuous monitoring of multi‑engine scanners such as VirusTotal is advised to capture any shift in detection counts. Incident response teams should assume any authentication attempts directed at services behind this domain are compromised and should initiate appropriate containment and forensic procedures. Sharing observations with peer threat‑intel communities will help improve collective awareness of this active phishing infrastructure.