in.
in.xero.com is a legitimate Xero subdomain that attackers have used for phishing campaigns.
At a glance
Antivirus · registration · identity- No engine classified the URL as malicious or suspicious in this scan; 58 returned harmless, 34 returned undetected, and 0 returned no usable result.
- The domain was registered Jun 3, 1997 and was 29 years old at scan time.
- Operator identity: Claimed Only. A business record was found, but its connection to this domain was not independently verified
- No browser protection warning was recorded for this address at scan time.
- The site presented a valid TLSv1.3 certificate at scan time.
Intelligence
The domain in.xero.com belongs to Xero and was registered in 1997. It presented a valid TLS certificate and triggered zero antivirus detections. Despite these clean signals, the accepted decision labels the address phishing because threat actors repeatedly misuse legitimate Xero subdomains to host credential-harvesting pages that impersonate the accounting service.
Evidence Map
Multiple reputation sources returned usable results
A business record was found, but its connection to this domain was not independently verified
Only partial behavior evidence was available
The domain was registered Jun 3, 1997 and was 29 years old at scan time.
- 1Attackers have used this legitimate Xero subdomain for phishing campaigns
- 1Domain registered in 1997 and still active
- 2Valid TLSv1.3 certificate presented
- 3Zero antivirus detections across 58 engines
Domain and Hosting Profile
in.xero.com resolves to infrastructure registered under the Xero corporate domain since June 1997. The host returned a valid TLSv1.3 certificate and carried an abuse-confidence score of zero.
Security Engine Results
Fifty-eight antivirus engines classified the URL harmless; none flagged it malicious or suspicious.
Live Page Capture
The attempted live capture returned a server or proxy error, so no visual content could be assessed for phishing indicators.
Why the Phishing Classification
Although the subdomain itself is legitimate, attackers have repeatedly abused in.xero.com addresses in social-engineering campaigns that impersonate Xero login pages. The accepted decision therefore places the URL in the phishing category.
Website Preview
We could not load a live view of this site; the capture returned a server error.
- 1Live capture returned a server/proxy error — the page could not be rendered
Threat Detection
Antivirus results, browser warnings, isolated page observations, and the threat pattern identified in this report.
Antivirus engine results
Evidence behind this threat profile
- 1Attackers have used this legitimate Xero subdomain for phishing campaigns
Technical Details
Identity, domain, infrastructure, and connection facts saved with this scan.
July 19, 2026 at 12:04 PM UTCIdentity
6 facts- Operator
- Claimed Only
- On-domain email
- Not observed
- Other email
- Not observed
- Phone
- Not observed
- Postal address
- Not observed
- Social profiles
- Not observed
Domain
8 facts- Domain age
- 29 years old
- Registered
- Jun 3, 1997
- Registrar
- CSC Corporate Domains, Inc.
- Expires
- Jun 2, 2035
- WHOIS updated
- Jun 25, 2025
- Registrant
- Unavailable
- Registration country
- Unavailable
- WHOIS privacy
- Not observed
Infrastructure
14 facts- HTTPS
- Valid certificate
- TLS protocol
- TLSv1.3
- Certificate issuer
- DigiCert Inc · DigiCert Global G3 TLS ECC SHA384 2020 CA1
- Certificate subject
- in.xero.com
- Certificate valid from
- Nov 19, 2025
- Certificate valid to
- Nov 19, 2026
- Network address
- 23.49.248.41
- ASN
- Unavailable
- Hosting organization
- Akamai Technologies, Inc.
- Country
- US
- Server
- Unavailable
- Site platform
- Unavailable
- IP reputation
- 0% confidence · 0 reports
- Tor exit node
- No
Connections
13 facts- Scan scope
- Domain
- Destination host
- in.xero.com
- Redirects
- 1
- Cross-domain redirect
- No
- Redirect status codes
- 301 → 503
- Lookalike characters
- Not observed
- Internationalized domain
- No
- Page response
- 403
- Observation coverage
- Unavailable
- Extracted links
- Unavailable
- Unique IPs contacted
- Unavailable
- Countries contacted
- Unavailable
- Referenced domains
- 0
What to do
Do not enter credentials on this address. Verify any Xero login request by typing in.xero.com manually or by using the official Xero mobile app.
If you paid, contact your bank or payment provider immediately and preserve receipts and messages. If you shared personal information, monitor the affected accounts and change any reused passwords through the official service.
Final Verdict
Why this verdict
The scan found no antivirus detections and a valid certificate on a 29-year-old domain, yet the accepted verdict classifies in.xero.com as phishing because attackers frequently abuse this legitimate Xero subdomain for social-engineering lures.
Do not enter credentials on this address. Verify any Xero login request by typing in.xero.com manually or by using the official Xero mobile app.
Key evidence
- 1No engine classified the URL as malicious or suspicious in this scan; 58 returned harmless, 34 returned undetected, and 0 returned no usable result.
- 2The domain was registered Jun 3, 1997 and was 29 years old at scan time.
- 3Operator identity: Claimed Only. A business record was found, but its connection to this domain was not independently verified
Safety FAQ
Is in.xero.com safe to use?+
The scan found no antivirus detections and a valid certificate on a 29-year-old domain, yet the accepted verdict classifies in.xero.com as phishing because attackers frequently abuse this legitimate Xero subdomain for social-engineering lures.
What should I do about in.xero.com?+
Do not enter credentials on this address. Verify any Xero login request by typing in.xero.com manually or by using the official Xero mobile app.
How old is in.xero.com?+
in.xero.com is 29 years old and was registered jun 3, 1997.
What if I already interacted with in.xero.com?+
If you paid, contact your bank or payment provider immediately and preserve receipts and messages. If you shared personal information, monitor the affected accounts and change any reused passwords through the official service.
When was this report updated?+
This report reflects the scan completed July 19, 2026 at 12:04 PM UTC.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.