xlnqshoxqv[.]my

Analysis of the domain xlnqshoxqv.my, created on 21 February 2026, indicates an elevated phishing threat that has been taken offline as of the report date. The domain was flagged by PhishDestroy and appears on one public security blocklist. VirusTotal reports that 14 of 93 scanning engines have classified the host as malicious, confirming the presence of suspicious activity despite the limited detection coverage. Network resolution points to the IP address 104.21.88.217, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States.

The TLS certificate presented for the site is identified as “WE1”, suggesting a possibly self‑signed or low‑reputation certificate. The combination of a recently registered domain, Cloudflare front‑end hosting, and multiple vendor detections aligns with typical infrastructure used for credential‑harvesting campaigns. Because the site is currently offline, active exploitation cannot be confirmed, but the historical indicators warrant continued vigilance. Defenders should ensure that any outbound connections to 104.21.88.217 are blocked at the network perimeter and that the domain name is added to internal DNS blocklists.

Monitoring for re‑registration of the domain or the emergence of similar sub‑domains on the same IP range is recommended. Correlating internal logs for attempted connections to the domain or its IP during the window of activity may reveal compromised credentials or phishing attempts. Organizations using phishing‑detection feeds should prioritize this indicator given the elevated risk rating and the multi‑vendor consensus.