17674[.]xyz

This domain operates as a credential harvesting site designed to steal user login information through deceptive login portals. Analysis indicates the infrastructure mimics legitimate authentication pages to trick victims into submitting usernames, passwords, and potentially multi-factor authentication codes. The site remains fully operational, presenting an ongoing threat to individuals and organizations unaware of its fraudulent nature. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain 17674.xyz was registered on June 29, 2026, through GMO Internet, Inc., with an SSL certificate issued to Default Company Ltd, a common pattern in phishing campaigns. Detection engines on VirusTotal flagged the domain as malicious, with 5 out of 95 security vendors identifying it as a phishing threat. The site currently resolves to the IP address 103.27.177.164, which has been associated with previous fraudulent activities in other campaigns. Individuals who have visited 17674.xyz or entered credentials on the site should take immediate action to mitigate potential compromise. First, change passwords for any accounts accessed through the site, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available to add an additional security layer. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the respective service providers. Organizations should consider blocking the domain and IP address at the network level to prevent further exposure to employees or users.