268365n[.]com

This domain, 268365n.com, operates as a credential-harvesting phishing portal designed to mimic legitimate login pages. Analysis indicates the site captures usernames, passwords, and potentially multi-factor authentication codes entered by unsuspecting users. Once collected, these credentials are typically used for unauthorized account access, financial fraud, or identity theft. The site may also distribute malware under the guise of required software updates or security verifications. Infrastructure analysis reveals the domain was registered on October 8, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It currently resolves to the IP address 20.247.100.105, hosted on a cloud provider known for transient malicious activity. Detection metrics show 12 out of 95 security vendors flag 268365n.com as malicious on VirusTotal, while AlienVault OTX lists it in one threat intelligence pulse, confirming its use in active phishing campaigns. If you have visited 268365n.com or entered any information on the site, immediate action is required. Disconnect the device from the network and run a full antivirus scan to detect potential malware. Change passwords for all accounts accessed from the compromised device, prioritizing email, banking, and social media platforms. Enable multi-factor authentication where available and monitor financial statements for unauthorized transactions. Report the incident to relevant cybersecurity authorities or your organization’s IT security team to assist in containment and mitigation efforts.