bhd660bf367144d4ac0b5e290f[.]xo[.]je

Analysis indicates that the domain bhd660bf367144d4ac0b5e290f.xo.je is currently active and classified as a generic phishing threat with a high risk rating. The domain resolves to the IPv4 address 185.27.134.207, and no nameserver information is available, which limits attribution of the hosting infrastructure. Independent security services have flagged the domain: 14 of 91 vendors on VirusTotal have reported detections, and Google Safe Browsing classifies it as a social‑engineering site. The domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation platform.

These data points collectively confirm that the site is being used for fraudulent purposes. Because the domain lacks publicly visible registrar or SSL details in the current intelligence set, further infrastructure profiling is required to determine ownership, certificate usage, and potential hosting provider relationships. Defenders should immediately add 185.27.134.207 to network‑level deny lists and enforce DNS block rules for bhd660bf367144d4ac0b5e290f.xo.je.

Monitoring of outbound traffic to this address should be intensified, and any internal connections that attempt to resolve the domain should be logged and investigated. Given the active status, continuous re‑evaluation of blocklist coverage and threat‑intel feeds is advised to capture any changes in detection ratios or additional blocklist inclusions. Organizations using web filtering should ensure the domain is marked as malicious, and incident response teams should treat any credential or credential‑like data submitted to this domain as compromised.