1111111111xzc[.]sbs

As of July 24, 2026, the domain 1111111111xzc.sbs has been confirmed as a phishing site. The domain was registered on December 03, 2025, through Dynadot LLC, a well-known domain registrar. Infrastructure analysis reveals that the domain is currently offline and has been taken down, likely due to its malicious activities. The domain resolves to the IP address 188.114.97.3, which is located in the United States and is associated with Cloudflare, Inc. (AS13335).

This suggests that the domain was using Cloudflare's services to enhance its online presence and potentially mask its true origin. The SSL certificate for the domain is issued by Google Trust Services, indicating that the operators of the domain attempted to establish a level of trust with users, a common tactic in phishing operations. When the domain was active, it displayed a '504: Gateway time-out' error, which could have been a deliberate attempt to avoid immediate detection or an issue with the backend infrastructure. The domain appears on at least one security blocklist and has been flagged by 6 of 95 security vendors on VirusTotal, further corroborating its malicious nature.

Defenders should treat any traffic or engagement with this domain as suspicious and ensure that their systems are updated with the latest blocklists to prevent any potential phishing attempts. Although the domain is currently offline, it is advisable to remain vigilant as phishing operators often reuse or recycle domains. Additional analysis of the domain's content and activities when it was active would provide more detailed insights into the specific tactics and targets of the phishing campaign. However, the existing evidence strongly suggests that the domain was used for phishing activities and should be avoided.