f236v[.]xyz

On 23 July 2026, the domain f236v.xyz was observed as an active generic phishing infrastructure that has since been taken offline. The domain was registered on 12 March 2026 through Gname.com Pte. Ltd., and its authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4., ns1.dnsbm.com, and ns2.dnsbm.com. DNS resolution maps the domain to the IP address 45.196.247.27, which is assigned to Nebula Global LLC and geolocated to Hong Kong. No TLS certificate was associated with the host at the time of analysis, indicating the site operated without HTTPS protection.

VirusTotal scanned the domain and 23 of 94 security vendors returned a positive detection, reflecting a consensus that the host is malicious. Independent security tooling assigned a Gridinsoft trust score of 0 out of 100, and the domain is listed on a single security blocklist. Additionally, the PhishDestroy service has explicitly blocked the domain. The combination of a recent registration date, dedicated name servers, a low‑reputation hosting provider, and multiple vendor detections points to a purpose‑built phishing operation that likely leveraged the domain for credential harvesting or fraudulent redirects before being shut down.

Uncertainty remains regarding the specific payload or credential‑capture mechanisms because no page content, HTTP response codes, or Safe Browsing verdicts are available. Analysts have not observed a valid SSL certificate, which may have limited the attacker’s ability to present a convincing secure connection, yet the lack of HTTPS does not preclude successful phishing if the site relied on HTTP. Defenders should continue to monitor the associated IP address and name server hostnames for any resurgence, incorporate the domain and its IP into inbound and outbound filtering rules, and share the indicators with threat‑intelligence feeds.