089742[.]com

This domain, 089742.com, is currently active and resolves to the IPv4 address 103.193.148.167. Registration data shows it was created on 27 October 2019 through GoDaddy.com, LLC, and the authoritative name servers are v1s1.xundns.com and v1s2.xundns.com. The sole page retrieved during analysis carries the title “Welcome”, but no further content has been disclosed in the available intelligence. VirusTotal has recorded four detections out of ninety‑one scanning engines, indicating that a minority of security products have identified malicious behavior associated with the host.

The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy feed, reinforcing the view that it is being used for phishing‑related campaigns. No additional context such as target brand, specific phishing kit, or SSL certificate details are present in the current dataset. Consequently, the confidence in the phishing classification rests on the observed blocklist inclusion, the VirusTotal detections, and the generic “Welcome” page title commonly employed by lure sites.

Defenders should add 089742.com to network‑level deny lists, ensure DNS resolvers enforce blocklist policies, and monitor outbound connections to the IP 103.193.148.167 for potential data exfiltration. Security appliances should be updated to include the four VirusTotal‑reported signatures, and incident response teams should treat any credential submissions to this domain as compromised. Continued observation is advised to capture any evolution of the site, such as the deployment of login forms or additional malicious payloads.