y112l[.]xyz

Analysis indicates that the domain y112l.xyz was registered on February 21, 2026 and is presently taken offline. The sole page title returned by the site is the domain string itself, “y112l.xyz”, providing no additional context. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100 and Scamadviser assigns 1 out of 100, both indicating a high likelihood of malicious intent. VirusTotal submissions show that 12 out of 93 scanning engines flag the domain as malicious, which aligns with its classification as a generic phishing site.

The domain appears on one security blocklist and is specifically listed by PhishDestroy, confirming that at least one trusted blocklist provider has taken action against it. AlienVault OTX includes the domain in a single threat‑intelligence pulse, further corroborating its association with phishing campaigns. No additional data such as IP address, hosting ASN, SSL certificate details, or geographic location are available in the current intelligence set.

The combination of low trust scores, multiple vendor detections, blocklist inclusion, and OTX pulse suggests that the domain was actively used for phishing and should be considered high‑risk. Defenders are advised to ensure that y112l.xyz is blocked at network perimeter and DNS filtering layers, to monitor for any re‑registration or resurrection of the domain, and to update internal threat‑intel feeds with the observed indicators. Continuous re‑evaluation is recommended because the offline status may change if the operators reactivate the infrastructure.