14267[.]xyz

On 29 July 2026, the domain 14267.xyz was observed as part of an active generic phishing campaign. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service. VirusTotal scans show that 17 out of 91 antivirus and URL‑reputation engines have issued a detection for the domain, indicating a moderate level of consensus among security vendors that the site is malicious.

No additional intelligence such as registrar information, IP address, hosting ASN, or SSL certificate details has been released, and the page title or any brand‑targeted content has not been publicly disclosed. Consequently, the precise infrastructure supporting the campaign remains opaque, and the specific phishing lure employed by the site cannot be confirmed at this time. The available evidence suggests that the domain is being used to deliver phishing payloads, likely by presenting fraudulent login or credential‑collection pages, consistent with the “generic phishing” classification.

The presence on a blocklist and the multi‑vendor detections provide sufficient confidence for defensive operators to treat traffic to 14267.xyz as malicious. Recommended mitigation steps include adding the domain to network‑level deny lists, configuring web proxies to block HTTP/HTTPS requests to the host, and ensuring endpoint protection solutions are updated to include the latest signatures that flag the domain. Continuous monitoring of threat‑intel feeds for any newly disclosed indicators—such as resolved IP addresses, hosting provider changes, or additional blocklist entries—will help maintain an accurate defensive posture as the campaign evolves.