landbids[.]xyz

PhishDestroy identifies landbids.xyz as an active credential harvesting domain currently masquerading as a legitimate land auction or bidding service. The domain is under investigation with a status of active, indicating ongoing malicious operations. This threat specifically targets users seeking to participate in land sales or auctions, harvesting credentials through fake bidding portals.

This domain, landbids.xyz, is flagged by SEAL and appears on 1 security blocklist, indicating initial but unconfirmed malicious reputation. The domain was created on May 06, 2026, through Global Domain Group LLC, and resolves to IP 188.114.96.3. Notably, VirusTotal currently records 0 detections out of 95 scanners, though its SSL certificate is issued by Google Trust Services, a tactic frequently leveraged to instill false trust in potential victims. The combination of recent creation and low initial detection rates suggests early-stage deployment, a common strategy for credential harvesting campaigns to evade immediate scrutiny.

Given the domain’s active status and low detection footprint despite blocklisting, PhishDestroy assesses this threat as under investigation but still poses significant risk due to its impersonation tactic and reliance on false SSL validation. Users are advised to avoid visiting landbids.xyz and to verify any land auction or bidding websites through official channels. Organizations should consider blocking the domain and IP 188.114.96.3 at the network perimeter. If credential exposure is suspected, users should immediately reset passwords and enable multi-factor authentication on relevant accounts. Continuous monitoring for related domains or campaigns is recommended due to the evolving nature of credential harvesting operations.