ncpanel[.]xyz

Analysis as of August 06, 2026 indicates that the domain ncpanel.xyz is currently active and classified as a generic phishing infrastructure. The domain resolves to the IP address 104.21.62.56, which is hosted on a Cloudflare network. VirusTotal records show that the domain was submitted to 91 scanning vendors; none reported a detection at the time of the scan.

Independent blocklist monitoring confirms that PhishDestroy has added the domain to its blocklist and that it appears on one additional security blocklist. No other public reputation services, such as Google Safe Browsing or Open Threat Exchange, have published entries for the domain, and no SSL certificate details or HTTP response codes are available in the current intelligence set. The limited data set prevents a full attribution of the hosting provider or the underlying malicious kit, but the combination of active resolution, blocklist inclusion, and the absence of detections despite multiple vendor scans suggests a deliberate attempt to evade automated filters while remaining reachable to potential victims.

Defenders should treat ncpanel.xyz as hostile: block DNS resolution and network traffic to the associated IP, add the domain to local and cloud‑based URL filtering policies, and monitor for any related command‑and‑control patterns. Continuous re‑scanning with multiple vendors is recommended to capture any future payload changes, and security teams should incorporate the domain into threat‑intel feeds used for endpoint and email protection. Given the active status and the generic phishing label, organizations should assume the site is being used to harvest credentials or deliver further malicious content until a more detailed investigation provides additional context.