xx1505[.]com

This domain, xx1505.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces designed to mimic legitimate financial or corporate authentication portals. Analysis indicates the domain is currently offline, though it previously posed an elevated risk of credential theft and unauthorized account access. No specific brand impersonation has been confirmed, but the infrastructure aligns with common phishing campaigns aimed at harvesting sensitive user data. Infrastructure analysis reveals xx1505.com was registered on February 27, 2019, through GoDaddy.com, LLC, and resolves to the IP address 103.143.28.212, located in Hong Kong under autonomous system AS135581. The domain has been flagged by 20 of 95 security vendors on VirusTotal, indicating broad detection as malicious. It appears on one security blocklist and utilizes a default SSL certificate issued to Default Company Ltd, a common indicator of low-effort phishing infrastructure. The page title, identical to the domain name, further suggests a lack of legitimate branding or content. Current status confirms the domain is offline, reducing immediate exposure risk. However, the historical infrastructure and detection metrics warrant continued monitoring. Organizations and users are advised to block the domain and associated IP address at the network level, revoke any credentials potentially exposed through this site, and implement multi-factor authentication to mitigate credential theft risks. Security teams should review logs for connections to 103.143.28.212 or related domains registered through the same registrar during the active period.