p208a[.]xyz

On July 23, 2026, the domain p208a.xyz was observed in an elevated‑risk brand‑impersonation campaign targeting Google credentials. The site’s HTML title is “welcome‑BET365”, which does not reference the intended victim brand, suggesting a reused template. The domain resolves to IP 45.196.247.26, an address registered to Nebula Global LLC in Hong Kong (AS140224). No TLS certificate was presented; attempts to establish an HTTPS connection fail, yet the HTTP response includes an HSTS header, indicating that the operator may have configured HSTS without a valid certificate. The web server identified by the response headers is Nginx serving a Vue.js application, a stack commonly used in commodity phishing kits.

The domain was registered on March 09 2026 through Gname.com Pte. Ltd., and its authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. The registrar and name‑server pattern match other known malicious infrastructures used in credential‑phishing operations. Reputation services flag the site as extremely untrustworthy: Gridinsoft assigns a score of 0 / 100, Scamadviser a score of 1 / 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 19 of 94 scanned engines raise a detection, confirming malicious classification. PhishDestroy has already taken the domain offline, and the current status is reported as “taken offline”.

Evidence confirms the campaign’s objective is credential harvesting against Google accounts, though the exact phishing page content has not been captured. The lack of SSL, combined with the presence of HSTS, suggests a hurried deployment that may be abandoned or moved to a new infrastructure. Defenders should block the domain and its resolved IP at network perimeter devices, update URL filtering feeds with the domain and associated name servers, and monitor for similar name‑server or IP patterns.