xbt8x82irz1kbcyq[.]hgsa242[.]com

This domain, xbt8x82irz1kbcyq.hgsa242.com, is currently flagged as a credential phishing endpoint targeting users through fraudulent login interfaces. Analysis confirms the domain remains active and is categorized under generic_phishing with a high-risk assessment. No specific brand impersonation has been identified, though the site employs standard phishing tactics to harvest user credentials. Infrastructure analysis reveals the domain was registered on April 23, 2026, through Spaceship, Inc., and resolves to the IP address 172.67.174.59. Security vendor detections on VirusTotal indicate 19 of 95 engines have flagged the domain as malicious. The domain appears on one security blocklist, and its page title, "welcome！", suggests an attempt to mimic legitimate landing pages. The registration date is notably in the future, which may indicate an attempt to evade temporal-based reputation checks. Current status confirms the domain remains operational, posing an ongoing threat to users. Organizations and individuals are advised to block the domain and its associated IP (172.67.174.59) at the network perimeter. Endpoint protection solutions should be updated to include this domain in deny lists. Users who may have interacted with the site should reset credentials immediately and monitor accounts for unauthorized activity. Security teams are encouraged to review logs for connections to the domain or IP to assess potential compromise.