268365i[.]com

The domain 268365i.com is currently flagged as an active credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is designed to impersonate legitimate authentication pages, likely aiming to capture sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. The site remains operational, with no takedown or mitigation measures observed as of the latest assessment. Infrastructure analysis reveals the domain was registered on October 08, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 20.247.100.105, hosted within the AS8075 Microsoft Corporation network in Hong Kong. Security vendors have flagged the domain, with 18 of 95 VirusTotal engines detecting malicious activity. The domain appears on one security blocklist, specifically PhishDestroy, and uses a Let's Encrypt SSL certificate (R13) to create a false sense of legitimacy. The combination of recent registration, low detection thresholds, and hosting on a cloud provider infrastructure suggests an attempt to evade traditional security controls. Current risk assessment categorizes 268365i.com as high severity due to its active status, confirmed credential harvesting intent, and minimal blocklist coverage. Organizations are advised to implement immediate network-level blocking of the domain and its associated IP address (20.247.100.105) at the perimeter. Endpoint protection systems should be updated to include this domain in real-time phishing filters. Users who may have interacted with the site should be instructed to reset credentials, particularly if multi-factor authentication was not enforced. Security teams are recommended to monitor for related indicators, including subdomains or newly registered domains under the same registrar, as threat actors often rotate infrastructure to sustain campaigns.