63390[.]xyz

The domain 63390.xyz is identified as a brand impersonation threat targeting Gmail and is currently offline. This domain poses an elevated risk level due to its impersonation of a widely recognized and trusted brand, which can lead to significant user deception and potential data compromise.

Infrastructure analysis reveals that 63390.xyz resolves to the IP address 45.196.247.179, which is located in Hong Kong (AS132839 POWER LINE DATACENTER). The domain was registered on March 07, 2026, through Gname.com Pte. Ltd. The page title found is 'welcome-BET365', which does not align with the Gmail brand, indicating an attempt to mislead users. This domain has been flagged by 22 out of 95 VirusTotal security vendors, suggesting a moderate level of detection among the cybersecurity community. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. The absence of an SSL certificate further increases the risk, as it lacks the necessary encryption to secure user data.

Given the current offline status of 63390.xyz, the immediate risk is mitigated. However, continuous monitoring is recommended to ensure the domain does not come back online and resume its malicious activities. Organizations and individuals are advised to update their security filters and blocklists to include this domain. Users should be warned to verify the URLs and domain names of any Gmail-related web pages they access, and to report any suspicious activities to their IT departments. Implementing multi-factor authentication (MFA) and educating users on the signs of phishing can further reduce the risk of compromise.