f214n[.]xyz

f214n.xyz was registered on 21 February 2026 and is currently listed as offline. DNS resolution points to 45.196.247.164, an address hosted by Nebula Global LLC in Hong Kong. The sole page title returned from the host is the domain string itself, “f214n.xyz”, indicating that no additional branding or contextual information was captured before takedown. The domain appears on the PhishDestroy blocklist and is referenced by a single AlienVault OTX pulse, confirming its classification as a phishing infrastructure.

VirusTotal scans show that 12 of 93 antivirus and URL‑reputation engines flag the domain as malicious, further corroborating the threat assessment. No other public blocklists or safe‑browsing services are reported. Because the site is offline, analysts cannot verify the exact content, credential‑harvesting mechanisms, or targeted brands, leaving the precise phishing vector uncertain.

Nevertheless, the combination of recent registration, dedicated IP hosting, multiple vendor detections, and inclusion in known blocklists warrants an elevated risk rating. Defenders should immediately add 45.196.247.164 to network deny lists, enforce domain‑level blocking for f214n.xyz across DNS filters, and monitor for any re‑registration attempts or fast‑flux activity on the same IP range. Sharing the indicators of compromise with industry ISACs and updating intrusion‑detection signatures to include the observed OTX pulse identifier will improve collective protection against replicas of this campaign.