inlocker[.]xyz

This domain, inlocker.xyz, is designed to harvest user credentials through deceptive access verification pages. The site mimics legitimate login portals, tricking visitors into submitting sensitive account details such as usernames, passwords, and potentially multi-factor authentication codes. Analysis of the page structure and content indicates a focus on credential theft rather than financial fraud or malware distribution, with no direct evidence of crypto drainer functionality or brand-specific impersonation at this time. Infrastructure analysis reveals the domain was registered on April 21, 2026, through FewMoreTaps OÜ, a registrar frequently associated with malicious domains. It resolves to the IP address 217.60.39.100 and has been flagged by 11 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was previously identified in a single threat intelligence pulse, suggesting limited but confirmed malicious activity. The page title, Access Verification, aligns with common phishing tactics used to create a false sense of urgency. Users who visited inlocker.xyz should immediately reset credentials for any accounts entered on the site, particularly if reused across multiple platforms. Enable multi-factor authentication where available and monitor accounts for unauthorized activity. Network administrators should block the domain and its associated IP (217.60.39.100) at the perimeter. If financial or personal data was submitted, consider reporting the incident to relevant authorities for further investigation.