security-auth-usaa-256bit[.]xyz

Analysis conducted on July 24, 2026 identifies security-auth-usaa-256bit.xyz as an offline infrastructure linked to a generic phishing campaign. The domain was registered on February 21, 2026 and resolves to the IP address 91.202.233.156, which is assigned to AS200593 PROSPERO OOO in the Russian Federation. The SSL certificate associated with the domain is labeled "R13", indicating a self‑signed or otherwise low‑trust certificate. The site’s sole visible element is the page title "Secure System Transfer", which suggests a lure toward credential capture but no additional content has been examined. Reputation services flag the domain as highly suspicious.

Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser reports a score of 16 out of 100. VirusTotal analysis shows that 14 of 95 security vendors submitted a detection for the domain, and it appears on at least one public blocklist. The domain has also been listed by the PhishDestroy blocking service, confirming that defensive feeds recognize it as malicious. No evidence of legitimate use or remediation activity is present.

Uncertainty remains regarding the exact phishing kit, the targeted brand, and whether any active phishing pages were ever served before the takedown. The offline status prevents real‑time verification of the payload, and no screenshots or content hashes are available. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration attempts, and incorporate the observed indicators—domain name, IP, SSL label, and the 14 vendor detections—into detection rules. Ongoing threat‑intel feeds should be consulted for potential resurgence, and any inbound traffic to the IP should be logged and inspected for credential‑stealing activity.