# s114l.xyz — MALICIOUS

> Domain s114l.xyz is a generic phishing site flagged by 21 of 95 VirusTotal vendors. Active since March 2026, it mimics legitimate services to steal credentials.

## Summary
PhishDestroy identifies s114l.xyz as an active generic phishing domain currently propagating fraudulent campaigns. The domain is classified under the threat type 'generic_phishing' and maintains a high-risk classification, indicating ongoing malicious activity. At the time of investigation, no specific brand impersonation has been confirmed, though the domain exhibits classic phishing characteristics such as social engineering tactics.  This domain was flagged by 21 of 95 VirusTotal security vendors, demonstrating significant malicious reputation. The domain was registered through Gname.com Pte. Ltd. and resolves to IP address 45.196.247.27. It was created on March 12, 2026, and carries a valid SSL certificate issued by Let's Encrypt, adding a false sense of legitimacy. The domain is additionally flagged by Google Safe Browsing under the 'SOCIAL_ENGINEERING' category, further corroborating its malicious intent.  The current status of s114l.xyz remains active, and users are strongly advised to avoid interaction with this domain. Security teams should implement network-level blocking measures targeting both the domain and its resolved IP address. End users should report this domain to their security provider or relevant threat intelligence platforms. Organizations are encouraged to update threat intelligence feeds and firewall rules to prevent potential compromise via this vector. Continued monitoring is recommended due to the domain's recent creation and high-risk classification.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-12 09:14:55
- Registrar: Gname.com Pte. Ltd.
- IP: 45.196.247.27

## Detection Status
- VirusTotal: 21 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/e4ddb262-6e38-4718-a818-f9ee2687b3e9
- PhishDestroy: https://phishdestroy.io/domain/s114l.xyz/
- LLM endpoint: https://phishdestroy.io/domain/s114l.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/s114l.xyz/
Last updated: 2026-03-21