1565999777[.]com

This domain is assessed as elevated risk due to its association with generic_phishing operations. Although the current status indicates the infrastructure has been taken offline, historical indicators suggest the domain was used in a manner consistent with phishing campaigns designed to deceive users and collect sensitive information. The combination of detection activity and security blocking records supports continued classification as a threat-related asset despite its inactive state.

Infrastructure analysis reveals that 1565999777.com was registered through GoDaddy.com, LLC and was created on March 08, 2021. Historical resolution data shows the domain associated with IP address 23.145.136.51. The observed SSL certificate was issued to Default Company Ltd. Network attribution places the IP location in JP under AS209242 Cloudflare London, LLC. Security telemetry indicates that 20 out of 95 security vendors flagged the domain as malicious, representing a significant level of detection compared with benign domains. The domain appears on 1 security blocklist and has been specifically blocked by PhishDestroy. Current monitoring indicates that the domain is taken offline; however, offline status should not be interpreted as evidence of legitimacy because threat operators frequently abandon or rotate infrastructure after detection.

Recommended mitigation measures include maintaining blocks on the domain across DNS filtering, web proxy, email security, and endpoint protection controls. Security teams should review historical logs for connections to 1565999777.com and investigate any credential submissions or user interactions that may have occurred before the domain was disabled. Indicators including the domain name, IP address 23.145.136.51, certificate association, and registration details should be retained in threat intelligence repositories for correlation against future campaigns. Continued monitoring is advisable because infrastructure elements associated with generic_phishing operations are often reused, re-registered, or replicated under alternative domains to resume malicious activity.