# u98b.xyz — MALICIOUS > PhishDestroy identifies u98b.xyz as an active credential phishing domain flagged by 16 of 95 VirusTotal vendors. ## Summary PhishDestroy identifies u98b.xyz as an active generic phishing domain associated with an ongoing credential theft campaign. The domain is currently resolving to IP address 45.196.247.27 and remains accessible to end users seeking to impersonate legitimate login portals. This domain was flagged by 16 of 95 VirusTotal security vendors, operates under a Let's Encrypt SSL certificate, and was registered through Gname.com Pte. Ltd. on March 18, 2026. Despite its recent creation, multiple threat intelligence platforms have already included it in blocklists. Registrar data and historical WHOIS records do not indicate legitimate ownership or operational purpose. Given its elevated threat status and active propagation, PhishDestroy recommends immediate network-level blocking of u98b.xyz and all associated infrastructure. Organizations should inspect DNS logs for recent resolutions to 45.196.247.27 and scan endpoints for outbound connections. Users who may have entered credentials must reset passwords immediately and enable multi-factor authentication where available. ## Threat Details - Verdict: MALICIOUS - Site status: unknown (HTTP ?) ## Domain Intelligence - Registered: 2026-03-18 07:23:39 - Registrar: Gname.com Pte. Ltd. - IP: 45.196.247.27 ## Detection Status - VirusTotal: 16 vendors flagged - Google Safe Browsing: clean - Blocklists: 0 hits ## Evidence - Cloudflare Radar: https://radar.cloudflare.com/scan/900d45c7-6980-440b-8c7c-97f70c2ff4f9 - PhishDestroy: https://phishdestroy.io/domain/u98b.xyz/ - LLM endpoint: https://phishdestroy.io/domain/u98b.xyz/llm.txt ## If You Visited This Site 1. Change any passwords you may have entered 2. Enable 2FA on all related accounts 3. Monitor your accounts for unauthorized activity 4. Report to: FBI IC3, Europol, local authorities --- Report by PhishDestroy | https://phishdestroy.io/domain/u98b.xyz/ Last updated: 2026-03-28