18895[.]xyz

The domain 18895.xyz is currently listed on a security blocklist and remains active as of the report date, July 19, 2026. An HTTP request to the root of the domain returns a 200 OK status, indicating that a web server is reachable and delivering content. The blocklist entry notes that the domain has been intercepted by the PhishDestroy mitigation platform, which classifies it as malicious. VirusTotal records show that the domain has been scanned by 95 antivirus and URL‑reputation vendors; none of the scans produced a detection, but the lack of a detection does not constitute evidence of safety. No additional intelligence such as page title, targeted brand, or phishing kit has been published, so the precise content and intended victims are unknown. Because the domain is confirmed as active, resolves to a live site, and is already flagged by at least one reputable blocklist, defenders should continue to block traffic to 18895.xyz at the network perimeter, update URL filtering rules, and monitor for any new indicators that may emerge. Analysts should also request a deeper content inspection to determine the specific phishing payload, if any, and assess whether the domain is part of a broader campaign.