org-us[.]xyz

This domain is flagged as a high-risk phishing site designed to impersonate service status portals. Analysis indicates the threat type as a fake login or service impersonation scheme, likely intended to harvest credentials or distribute malware under the guise of a legitimate system status page. The page title "Service Status" reinforces this deception, targeting users expecting operational updates or maintenance notifications. Infrastructure analysis reveals the domain org-us.xyz resolves to IP address 104.21.10.212 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 17, 2026. It appears on three security blocklists and is flagged by 15 out of 95 security vendors on VirusTotal. AlienVault OTX includes the domain in two threat intelligence pulses, further corroborating its malicious classification. The creation date suggests recent registration, a common tactic in phishing campaigns to evade detection and maintain operational agility. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address at the network perimeter. Security teams should update endpoint protection rules to detect and prevent access to org-us.xyz and monitor for any attempts to visit the site within their environments. Users should be educated on recognizing fake service portals, particularly those using generic page titles like "Service Status" without verifiable branding or SSL certificates from trusted authorities. Logs should be reviewed for any connections to 104.21.10.212 or related domains registered through the same registrar, as these may indicate broader campaign activity.