semanticlayer-live[.]xyz

Analysis of semanticlayer-live.xyz indicates it was a phishing domain targeting users with a fake account suspension notice. The domain was registered on October 26, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 195.26.87.207, hosted in the Netherlands under AS43641 (SOLLUTIUM EU Sp z.o.o.). No SSL certificate was detected, increasing the likelihood of interception of unencrypted credentials. The page title 'Account Suspended' aligns with common account takeover phishing tactics, though the exact brand or service mimicked is not confirmed in available data.

The domain appears on two security blocklists and is flagged by 8 of 95 security vendors on VirusTotal, including detections by PhishDestroy and ScamSniffer. These indicators suggest the infrastructure was actively used for malicious purposes. As of July 25, 2026, the domain is offline, though defenders should treat any reactivation as high-risk. The nameservers ns1-ams.v-sys.org and ns2-ams.v-sys.org have been associated with other phishing campaigns, reinforcing the need for monitoring.

Defenders are advised to block the domain and its resolving IP at the network level, update endpoint protection signatures, and review logs for connections to 195.26.87.207 or the domain itself. While the domain is inactive, historical DNS records and WHOIS data should be preserved for forensic analysis. No evidence links this domain to a specific brand, so detection rules should focus on the 'Account Suspended' page title and infrastructure patterns rather than brand-specific keywords.