glazeworld[.]xyz

PhishDestroy identifies glazeworld.xyz as a credential-harvesting endpoint currently involved in an active phishing campaign. The domain resolves to IP address 92.113.23.176 via Hostinger UAB and was created on June 04, 2025. Security telemetry shows zero detections on VirusTotal (3/95) and no presence on public blocklists, indicating a newly deployed domain with minimal reputation filtering. Technical indicators point to a generic phishing kit tailored to harvest authentication credentials. The presence of a Let’s Encrypt SSL certificate suggests an attempt to appear legitimate and bypass browser security indicators. Hostinger’s infrastructure is commonly abused due to low-cost, rapid provisioning and weak abuse controls, enabling quick turnaround for malicious domains. The domain’s age and absence of historical telemetry make detection via reputation-based systems ineffective, elevating the risk of successful user compromise. Users who visited or entered information on glazeworld.xyz should immediately rotate passwords for any accounts linked to the site and enable multi-factor authentication where available. Check for unauthorized logins or account changes via security dashboards. Report the domain to your organization’s SOC or use browser-based reporting tools. Isolate affected devices if credential exposure is suspected and run a full antivirus scan. Organizations are advised to block 92.113.23.176 at network perimeters and monitor DNS queries for glazeworld.xyz or related subdomains. Continued monitoring is required as detection signatures evolve.