layerwebnode[.]xyz

Analysis of layerwebnode.xyz (registered 17 July 2026) shows that the domain is hosted on Cloudflare DNS (jaziel.ns.cloudflare.com, ziggy.ns.cloudflare.com) and resolves to IP 188.114.96.3. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was added to a security blocklist and is actively blocked by PhishDestroy, indicating that threat intelligence sources have identified it as malicious. VirusTotal has processed the domain with 95 antivirus and URL scanners; none of the engines returned a positive detection at the time of analysis. The lack of detections does not imply benign intent, especially given the blocklist entry and the classification as a generic phishing campaign. The domain’s age is less than a week, which is typical for fast‑flux or throwaway phishing infrastructure. No additional data such as SSL certificate details, HTTP response codes, Safe Browsing status, or Open Threat Exchange (OTX) reports are currently available, leaving uncertainty around the content served and the specific credential‑harvesting tactics employed. Defenders should continue to block traffic to 188.114.96.3 and to layerwebnode.xyz at network perimeter devices, update URL filtering rules to include the domain, and monitor for any related indicators of compromise that may appear in downstream logs. Given the recent creation date and existing blocklist entry, proactive containment is recommended while additional investigation (e.g., content retrieval in a sandbox) is performed to confirm the phishing payload.