18909[.]xyz

This domain, 18909.xyz, is actively engaged in credential theft operations targeting user login credentials. Analysis confirms its current status as active, with no legitimate use cases identified. The infrastructure is designed to harvest sensitive authentication details, likely for subsequent unauthorized access or financial fraud. Infrastructure analysis reveals the domain was registered on June 10, 2026, through GMO Internet, Inc., an uncommon registrar for legitimate services. It resolves to the IP address 103.27.177.163 and is flagged by 18 of 95 security vendors on VirusTotal. The domain appears on two security blocklists, including PhishDestroy and OpenPhish, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its low validation requirements. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its malicious classification. Current monitoring indicates the domain remains operational, posing an ongoing risk to users. Organizations and individuals are advised to implement immediate network-level blocking of 18909.xyz and its associated IP, 103.27.177.163. Endpoint protection solutions should be updated to include this domain in their deny lists. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Security teams are encouraged to monitor for related indicators of compromise, including connections to the resolving IP or similar domains registered through the same registrar.