genesis-biofoundation[.]xyz

This domain, genesis-biofoundation.xyz, is identified as a credential theft operation designed to harvest user login credentials through deceptive web pages. Analysis indicates the site mimics legitimate authentication portals, tricking visitors into submitting sensitive information such as usernames, passwords, or multi-factor authentication codes. The infrastructure is structured to appear authentic, often leveraging cloned branding or urgent messaging to prompt immediate user action, which is a hallmark of targeted credential harvesting campaigns. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, indicating moderate but consistent recognition of malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to the IP address 104.21.66.77 and is currently offline, though this status may change. The domain appears on one security blocklist and is blocked by at least one known threat mitigation system. Technologies detected include Cloudflare and HTTP/3, suggesting the use of modern web infrastructure to evade detection and enhance delivery speed. Users who visited genesis-biofoundation.xyz should assume their credentials may have been compromised. Immediate actions include changing passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. If financial or personally identifiable information was submitted, affected individuals should report the incident to relevant authorities and consider credit monitoring services. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered during the visit. Organizations should update internal blocklists to prevent access to this domain and its associated infrastructure.