xenoptil[.]online

On 23 July 2026, the domain xenoptil.online was observed as an offline generic phishing site. The domain was registered on 21 February 2026 through Unstoppable Domains, Inc., and is delegated to Google Cloud DNS name servers ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledomains.com. DNS resolution points to IP address 45.9.148.51, which belongs to ASN 49447 operated by Nice IT Services Group Inc. and is geolocated in the Netherlands. The HTTPS service presents a certificate issued to “Hestia Control Panel / 8102be99.as49447.net”, indicating the use of a generic control‑panel certificate rather than a domain‑validated certificate tied to the domain itself.

The page title returned by the server is “Success!”, but no further content analysis is available because the site is currently taken offline. VirusTotal has recorded 13 detections out of 93 scanning engines, demonstrating that a minority of security products flag the domain as malicious. In addition, Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single external blocklist, where it is actively blocked by the PhishDestroy service. The limited detection coverage and low trust score suggest that the infrastructure is likely being used for phishing campaigns, though the specific target or credential‑stealing kit cannot be confirmed from the available data.

Given the observed infrastructure, defenders should incorporate the domain and its resolved IP address into network‑level blocklists and ensure that any outbound connections to 45.9.148.51 are denied. Continuous monitoring of the associated ASN and the Google Cloud DNS name servers is advisable, as they may host additional malicious domains. Re‑checking the domain with reputation services after a reasonable interval is recommended, as the site may be re‑activated or repurposed.