p89z[.]xyz

This domain, p89z.xyz, has been taken offline but continues to be referenced by multiple security datasets. It appears on one known security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows that fifteen out of ninety‑three antivirus and URL scanning engines flagged the domain as malicious, indicating a non‑trivial detection rate. The Gridinsoft trust score of 0 / 100 and the Scamadviser rating of 1 / 100 further confirm a very low reputation. AlienVault OTX lists the domain in fifteen separate threat‑intelligence pulses, reinforcing its association with malicious activity.

The domain was registered on 11 September 2025 through Gname.com Pte. Ltd., a registrar that does not provide additional privacy shielding. The page title reported by the crawler is simply “p89z.xyz”, offering no indication of a targeted brand or service. No publicly available information on the hosting IP address, autonomous system number, geographic location, or SSL certificate is present in the current intelligence set. Because the site is currently offline, active probing is not possible, yet the historical indicators suggest it was used for a generic phishing campaign.

Defenders should ensure that the domain is added to network‑level deny lists, DNS sinkhole configurations, and endpoint URL filtering rules. Continuous monitoring of any future DNS resolution attempts for p89z.xyz is advised, as threat actors may reactivate the domain or leverage similar naming patterns. Correlation with the fifteen OTX pulses can help enrich detection rules and improve coverage in security information and event management (SIEM) platforms. Organizations should also consider reviewing logs for past connections to this domain during the period after its creation in September 2025, as retrospective analysis may uncover compromised credentials or data exfiltration attempts.