f109z[.]xyz

Analysis of the domain f109z.xyz indicates that it was registered on 27 July 2025 through the registrar Gname.com Pte. Ltd. The domain resolves to the IPv4 address 110.42.43.240, which is allocated to ASN 136188 in Ningbo, Zhejiang Province, China. No TLS certificate is presented, meaning the site was reachable only over HTTP. The page title returned by the host is the literal string “f109z.xyz”. Trust‑rating services assign extremely low scores: Scamadviser reports a 1 / 100 rating and Gridinsoft a 0 / 100 rating, reflecting a high likelihood of malicious use.

VirusTotal records show that 14 of 95 scanned security vendors flagged the domain, indicating detection by multiple AV engines. AlienVault OTX lists the domain in 16 separate threat‑intelligence pulses, and it appears on a single public blocklist. The domain is currently listed as offline, and it has been blocked by the PhishDestroy mitigation service. The available evidence points to a generic phishing campaign, consistent with the threat type classification.

The infrastructure—Chinese hosting, absence of SSL, and rapid registration—matches patterns observed in other credential‑stealing operations. Defenders should continue to block the domain at perimeter filters, update DNS blocklists with the observed IP address, and monitor for any re‑registration attempts. Because the site is offline, direct analysis of its payload is not possible; however, the prevalence across multiple vendors and threat‑intel feeds suggests that it was actively used to harvest credentials. Organizations should educate users about the risk of unsolicited URLs and enforce multi‑factor authentication to mitigate potential compromise.