61491[.]xyz

Analysis of the domain 61491.xyz, created on February 20, 2026 and currently active, shows a typical infrastructure used for credential‑stealing operations. The domain is secured with a Let’s Encrypt certificate issued under the YR1 profile, indicating the use of free TLS provisioning. DNS resolution points to the IP address 103.27.177.164, which is registered to Hong Kong Kowloon Telecommunications Co., Limited. The hosting environment is fronted by Cloudflare, as evidenced by the presence of Cloudflare‑managed nameservers (a.share-dns.com, a3.share-dns.com, b.share-dns.net, b3.share-dns.net) and the detection of HTTP/3 support.

Web‑server fingerprints reveal Nginx serving a Vue.js application, with HTTP Strict Transport Security (HSTS) enforced, suggesting an attempt to improve perceived legitimacy. Security‑vendor scanning on VirusTotal reports that six out of ninety‑one antivirus engines flag the domain, indicating a modest but notable level of malicious detection. The domain appears on a single public blocklist and is already blocked by the PhishDestroy filtering service, confirming that at least one downstream security product has identified it as abusive. Registration was performed through Gname.com Pte. Ltd., a registrar known to host both legitimate and malicious domains, providing no further attribution.

While the exact brand or service being spoofed has not been disclosed in the available intelligence, the technical footprint aligns with known generic phishing kits that rely on modern web frameworks and CDN acceleration to evade detection. Defenders should block 61491.xyz at network perimeter devices, incorporate the IP address 103.27.177.164 into threat‑intel feeds, and monitor for any outbound connections to the associated Cloudflare edge nodes.