gov-nillion[.]xyz

gov-nillion.xyz is currently listed as an offline generic phishing site. The domain was registered through Dynadot LLC on 5 December 2025 and resolves to the Cloudflare edge address 188.114.97.3, which is assigned to ASN 13335 (Cloudflare, Inc.) located in the United States. No TLS certificate is presented for the domain, indicating that HTTPS connections are not available. The infrastructure uses Cloudflare’s default nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, a common configuration for malicious actors seeking rapid deployment.

Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline and reports it as blocked. VirusTotal analysis shows that 10 of 95 scanned security vendors flagged the domain, confirming malicious classification despite the relatively low detection ratio. The limited detection count and single blocklist entry suggest that the campaign may have been short‑lived or narrowly targeted.

Defenders should add 188.114.97.3 and the domain name to deny‑list rules across firewalls, DNS filters, and proxy solutions, and monitor for any resurgence of similar Cloudflare‑hosted infrastructure. Ongoing observation of Dynadot‑registered domains created after December 2025 that resolve to the same IP range is recommended to catch potential re‑use. Because the site is offline, active mitigation is limited to preventive blocking, but future requests to the domain should be logged and investigated for possible credential harvesting attempts. The evidence set, while concise, provides sufficient confidence to treat gov-nillion.xyz as a confirmed phishing host.