18075[.]xyz

This domain, 18075.xyz, is classified as a high-risk credential theft operation designed to deceive users into disclosing sensitive login credentials. Analysis indicates the infrastructure is actively targeting individuals through fraudulent login portals, likely mimicking legitimate services to exploit trust. The specific threat type—credential theft—poses significant risks, including unauthorized account access, identity fraud, and potential financial loss for victims. Infrastructure analysis reveals the domain was registered on June 28, 2026, through the registrar GMO Internet, Inc. It currently resolves to the IP address 154.39.104.132, which may host additional malicious content. The domain's SSL certificate is issued by Let's Encrypt, a common tactic to lend a false sense of legitimacy. Detection metrics further confirm its malicious nature, with 11 out of 95 security vendors on VirusTotal flagging the domain as harmful. Despite these warnings, the domain remains active, indicating ongoing or evolving malicious activity. To mitigate risks associated with credential theft, users should avoid interacting with 18075.xyz or any linked resources. Organizations are advised to block the domain and its resolving IP at the network level to prevent access. Individuals who may have entered credentials on the site should immediately reset passwords for all associated accounts, enable multi-factor authentication where available, and monitor for unauthorized activity. Security teams should review logs for connections to 154.39.104.132 or related domains to identify potential compromises. Proactive measures, such as user education on recognizing phishing attempts and implementing email filtering rules, can reduce the likelihood of successful credential theft incidents.