89240[.]xyz

Analysis of 89240.xyz indicates an active credential-phishing domain registered on February 1, 2026, through Gname.com Pte. Ltd. As of July 29, 2026, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal scans show 17 of 91 security vendors flagging the domain as malicious, providing a technical basis for elevated risk classification. No additional infrastructure details, such as hosting provider, autonomous system number, or SSL certificate issuer, are currently available in the supplied intelligence.

The exact content or brand impersonation remains unconfirmed, as no page title, phishing kit identifier, or targeted brand is specified in the evidence. Defenders should treat this domain as hostile and implement blocking at DNS or proxy level.

Network logs should be reviewed for connections to 89240.xyz, particularly from endpoints exhibiting anomalous authentication patterns or unexpected credential prompts. Given the domain's recent registration and multi-vendor detection, monitoring for related domains registered through the same registrar may help identify broader campaign infrastructure.