How to block https://xanthorox.net

For Web filter to work properly deep inspection need to be used on the policy.
But if that is not an option for you, you can block the ip address of the relevant website unless the ip is dymanic then you can use FQDN on the policy.

This is classified by FortiGuard as Phishing / Security Risk / High Risk.

You just need to block Phishing category in your web filter and you are done.