circle[.]teukusulthan[.]xyz

Analysis of circle.teukusulthan.xyz, a domain created on 17 October 2025, indicates that it has been used for a phishing campaign. The site presented the page title “Circle” but no SSL certificate was observed, meaning the service was reachable only via HTTP. DNS resolution points to the IPv4 address 64.29.17.65, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain is delegated to Cloudflare nameservers james.ns.cloudflare.com and jill.ns.cloudflare.com, a common choice for fast‑flux and abuse‑resilient hosting. Google Safe Browsing has classified the URL with two social‑engineering warnings, confirming the presence of malicious intent.

The domain appears on a single external blocklist and has been taken down by the PhishDestroy takedown service. Independent scanning on VirusTotal showed that 12 of 95 security engines generated a detection, reinforcing the suspicion. Gridinsoft’s trust scoring system assigned a score of 0 out of 100, the lowest possible rating, indicating an extremely high risk level. The registrar listed is Web Commerce Communications Limited, but no further WHOIS data is provided. No HTTPS/TLS certificate was observed, which prevents cryptographic validation of the server identity and facilitates credential harvesting.

The current operational status is offline, which limits immediate interaction but does not eliminate the possibility of re‑use of the same infrastructure. Uncertainties remain regarding the exact phishing payload, target audience, and whether the domain was part of a larger campaign. Defenders should add the IP address 64.29.17.65 to network‑level deny lists, monitor for any future DNS records pointing to the same address, and ensure that email filters reference the domain and its associated URL patterns. Continuous observation of Cloudflare name servers for new subdomains linked to this registrar is advisable.