xarneloq.shop

PhishDestroy first observed xarneloq.shop on Sep 20, 2026. The captured page title is “Sorry, the website has been stopped”. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 15 detections among 89 engines: alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Sep 20, 2026 at 14:19 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories malware, dga domains, and security threats; its verdict timestamp was not retained. URLQuery recorded 5 threat-system alerts on Sep 20, 2026 at 10:12 UTC. Non-positive and contextual checks: On Sep 20, 2026 at 14:20 UTC, AlienVault OTX listed 5 community pulse references (not vendor detections); The separate external-blocklist snapshot contained no matches; Google Safe Browsing returned no flag. URLScan captured the page on Sep 20, 2026 at 10:07 UTC.

The collector marked the hostname reachable on Sep 20, 2026 at 10:07 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 94.154.172.92 on AS209101 (IP Vendetta Inc.). The recorded endpoint location is Victoria, SC. The evidence archive retains 4 visual captures from PhishDestroy, URLScan, and URLQuery.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.