dymlabs[.]xyz

Analysis of dymlabs.xyz, observed on 24 July 2026, shows that the domain was created on 3 July 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the Cloudflare address 104.21.26.253, which is registered to AS13335 in the United States. The site presented a single page whose HTTP response contained the title “Just a moment…”, and no TLS certificate was presented, indicating an unencrypted HTTP service. The domain is listed on one public security blocklist and has been flagged by PhishDestroy.

VirusTotal reports indicate that four out of ninety‑five scanning engines identified malicious behavior, reinforcing the suspicion of abuse. Gridinsoft assigns a trust score of zero out of one hundred, reflecting an extremely low confidence in the site's legitimacy. Current network checks show the host is offline, which aligns with the takedown action reported by defensive feeds. The available evidence confirms that dymlabs.xyz is being used for a generic phishing operation, although the specific target brand or credential‑harvesting technique cannot be determined from the limited page content.

The lack of an SSL certificate, the generic page title, and the low trust score collectively suggest that the site was intended to capture user data without employing sophisticated obfuscation. Defenders should continue to block the domain at perimeter filters, add the associated IP address 104.21.26.253 to blacklists, and monitor for any re‑registration or new subdomains under the same registrar. Ongoing surveillance of Cloudflare‑hosted infrastructure is advised, given the prevalence of abuse on shared services. Until the site is definitively taken offline, security teams should treat any traffic to dymlabs.xyz as hostile and quarantine related alerts.