2365l[.]com

The domain 2365l.com is currently classified as a high‑risk generic phishing host and remains active as of July 12 2026. Registration data shows it was created on May 30 2016 through GoDaddy.com, LLC, and resolves to the IP address 103.143.28.212, which is assigned to an autonomous system based in Hong Kong (AS135581 ONL‑HK). DNS resolution uses Cloudflare nameservers (dee.ns.cloudflare.com and santino.ns.cloudflare.com), indicating the infrastructure is behind Cloudflare’s CDN and DDoS protection services. The site presents an HTTP 200 response and serves a default SSL certificate issued to "Default Company Ltd," a common placeholder when no dedicated certificate is installed. Threat intelligence sources have flagged the domain: PhishDestroy has blocked it, AlienVault OTX lists it in a single pulse, and it appears on one public blocklist. On VirusTotal, 19 of 93 scanning engines report it as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The page title returned is simply "2365l.com," providing no additional context about the content or targeted brand. Given the limited public information about the page’s payload, analysts cannot confirm the exact phishing technique employed, but the convergence of multiple detections, low trust rating, and active hosting suggests a live credential‑stealing operation. Defenders should immediately block outbound connections to 103.143.28.212 and inbound requests to 2365l.com, update intrusion‑detection signatures to include the domain and its associated IP, and monitor DNS queries for the Cloudflare nameservers. Continuous observation of traffic patterns and periodic re‑scans are advised to detect any changes in the site’s behavior or additional malicious payloads.