commom[.]xyz

This domain is flagged as an elevated-risk credential harvesting phishing site designed to deceive users into submitting login credentials. Analysis indicates the infrastructure is specifically engineered for impersonation attacks, likely targeting financial or corporate authentication portals given the observed page title 'Common' and rapid blocklisting by multiple security entities. Infrastructure analysis reveals the domain commom.xyz was registered on October 27, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 104.21.72.42. The domain appears on two security blocklists and is actively blocked by ScamSniffer and PhishDestroy. Reputation metrics further confirm malicious intent, with a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, with the page title 'Common' suggesting a generic but effective lure for credential collection. Mitigation requires immediate blocking of the domain and its resolving IP address across network security controls. Organizations should deploy email filtering rules to quarantine messages containing links to commom.xyz or its IP. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for pages with generic titles like 'Common.' Security teams are advised to monitor for secondary domains registered through the same registrar or resolving to the same IP, as this infrastructure may be part of a broader phishing campaign.