18799[.]xyz

Analysis of 18799.xyz indicates it is an active high‑risk phishing infrastructure. The domain appears on one known security blocklist and remains listed as active. VirusTotal scans show four of ninety‑one security vendors flag the host, confirming malicious intent. DNS resolution points to the IPv4 address 103.27.177.163, which responds with HTTP status code 200, indicating a reachable web service. The site is currently blocked by the PhishDestroy filtering solution. No additional intelligence such as page title, brand targeting, or malware kit has been disclosed, so the exact content and victim‑lure strategy remain unknown. Defenders should treat any traffic to 18799.xyz as malicious, enforce network‑level blocks, and update endpoint and proxy filtering rules to include the domain and its resolving IP. Continuous monitoring for new detections or changes in blocklist status is advised, as the threat actor may modify the payload or hosting infrastructure without notice.