11654455[.]com

Analysis of the domain 11654455.com indicates active brand-impersonation phishing infrastructure as of July 12, 2026. The domain was registered on April 8, 2022, through GoDaddy.com, LLC, and remains operational with an HTTP 200 status. It resolves to the IP address 103.143.28.212, hosted on AS135581 (ONL-HK) in Hong Kong. Nameserver records point to Cloudflare (dee.ns.cloudflare.com and santino.ns.cloudflare.com), a common pattern observed in phishing campaigns to obscure hosting origins and leverage CDN protections. The SSL certificate is issued to 'Default Company Ltd,' a generic placeholder often associated with low-effort or automated malicious deployments. The domain is currently flagged on one security blocklist and appears in two AlienVault OTX threat intelligence pulses, suggesting prior detection in related campaigns. VirusTotal reports 19 detections out of 93 security vendors, confirming cross-industry recognition of the domain as malicious. The page title, '11654455.com,' provides no additional context regarding the targeted brand or specific scam mechanics, though the scam type is classified as brand impersonation based on available intelligence. Defenders should treat this domain as high-risk. Recommended actions include blocking resolution at the DNS or firewall level, monitoring for internal connections to 103.143.28.212, and reviewing logs for interactions with Cloudflare nameservers associated with this domain. Given the domain's age and continued activity, it may be part of a persistent phishing operation rather than a short-lived campaign. Further analysis of the site's content is required to determine the exact brand being impersonated and the payload delivery mechanism, if any.