spllt[.]xyz

The domain spllt.xyz was registered on August 02, 2026 through Global Domain Group LLC. DNS resolution points to the IPv4 address 158.94.211.169 and the authoritative nameservers are a.dnspod.com, b.dnspod.com, and c.dnspod.com. The domain appears on one public security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has identified it as malicious. VirusTotal records show that the domain has been submitted to 91 scanning engines, none of which returned a detection at the time of analysis; this absence of detections does not constitute a safety guarantee. The short lifespan—creation only four days prior to the report date—combined with the immediate blocklist appearance suggests a rapid deployment typical of credential‑harvesting campaigns.

No SSL/TLS certificate information has been disclosed, and no HTTP status code or page title has been captured, limiting visibility into the content served by the site. The absence of a disclosed target brand or landing‑page snapshot prevents confirmation of the exact phishing lure, but the classification as generic phishing aligns with the threat‑type field provided in the intelligence feed. The use of dnspod.com nameservers, a service frequently leveraged by fast‑flux or disposable domains, may indicate an intent to obscure the true hosting environment.

Given the limited observation window, threat actors could still be refining the payload or victim‑targeting mechanisms. Defenders should consider adding spllt.xyz and its resolved IP address 158.94.211.169 to network‑level deny lists, enforce DNS filtering to block the domain, and monitor outbound traffic for connections to the listed nameservers. Organizations should also scrutinize any authentication attempts that involve credentials submitted to services hosted on the same IP range, and consider threat‑intel sharing with peers to accelerate detection of related indicators.