60718[.]xyz

This domain, 60718.xyz, is actively engaged in credential theft operations designed to harvest user login credentials, financial details, or other sensitive information. Analysis indicates the site employs deceptive login portals, often mimicking legitimate services such as email providers, banking platforms, or corporate intranet pages. The infrastructure is structured to capture submitted data in real time, redirecting victims to either a fake error page or the legitimate service to avoid immediate suspicion. Credential theft of this nature is frequently used to facilitate account takeovers, unauthorized transactions, or further targeted attacks against individuals or organizations. Infrastructure analysis reveals multiple red flags associated with 60718.xyz. The domain was registered on February 24, 2026, through Gname.com Pte. Ltd., a registrar commonly associated with high-risk registrations. It resolves to the IP address 103.27.177.163 and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. As of the latest assessment, 7 out of 95 security vendors on VirusTotal have flagged the domain as malicious, with detections including phishing, credential harvesting, and fraudulent activity. The domain remains active, indicating ongoing operational use in phishing campaigns. Users who have visited 60718.xyz or entered credentials on the site should take immediate action to mitigate potential compromise. First, change passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related credentials. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins, transactions, or password reset attempts. If financial information was submitted, contact the relevant institution to report potential fraud and request account monitoring. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts.