15657799[.]com

Analysis indicates that the domain 15657799.com is actively associated with phishing infrastructure. Registered on February 21, 2026, through GoDaddy.com, LLC, the domain resolves to the IP address 23.145.136.51, which is geolocated in Japan under AS209242, a Cloudflare London, LLC autonomous system. The domain's nameservers are also Cloudflare-hosted, suggesting potential abuse of Cloudflare services for anonymization or traffic distribution. The page title, '103.143.28.214:1565/', does not explicitly reveal a targeted brand or service, but the use of an IP address in the title may indicate an attempt to mimic technical or login portals. Security vendors have flagged this domain, with 17 out of 93 engines on VirusTotal detecting it as malicious. Additionally, the domain appears in two AlienVault OTX threat intelligence pulses and is listed on one security blocklist. The SSL certificate is issued to 'Default Company Ltd,' a common indicator of low-effort or automated phishing setups. The HTTP status code 200 confirms the domain is currently serving content, and it remains unblocked by some security mechanisms, as evidenced by its active status. Defenders should treat this domain as high-risk due to its recent registration, association with known phishing indicators, and use of Cloudflare infrastructure. Network-level blocking of the domain and its resolving IP (23.145.136.51) is recommended. Further investigation into the exact content or targeted brand is necessary, as the available data does not confirm whether this is a credential-harvesting page, a fake login portal, or another form of phishing. Monitoring for additional domains using the same nameservers or SSL certificate patterns may help identify related infrastructure.