xeyes[.]pro

Analysis of the domain xeyes.pro indicates active generic phishing infrastructure. The domain resolves to IP 188.114.97.3, a Cloudflare‑owned address located in Canada, and uses the authoritative nameservers venus.ns.cloudflare.com and kayden.ns.cloudflare.com. Registration records show the domain was created on April 28, 2026 by Fewmoretaps OU d/b/a Trustname.com. The site presents an HTTP 403 response and the page title is "Just a moment...", suggesting a cloud‑based challenge page rather than the final payload. Threat intelligence from AlienVault OTX cites the domain in eight separate pulses, and it appears on one public blocklist. Two of ninety‑one security vendors on VirusTotal have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100. The TLS certificate is issued by Let's Encrypt (E8). PhishDestroy has already listed the domain as blocked. While the exact phishing content has not been publicly documented, the convergence of registration, hosting, detection, and blocklist data establishes a high‑confidence phishing classification. Defenders should add xeyes.pro to network deny lists, monitor DNS queries for the associated Cloudflare IP, and consider broader threat‑intel correlation to identify any related campaigns.