14146[.]xyz

This domain, 14146.xyz, is identified as a credential theft phishing operation designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand impersonation or crypto drainer kit, but the infrastructure aligns with known credential harvesting campaigns. The domain hosts fraudulent pages mimicking legitimate services to trick users into submitting sensitive information, such as usernames, passwords, and multifactor authentication codes.

Infrastructure analysis reveals the following technical indicators: the domain is registered through Dynadot Inc and resolves to the IP address 103.27.177.164. It was created on May 09, 2026, and currently appears on one security blocklist. VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious. The domain employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the underlying content. No Google Safe Browsing (GSB) alerts are currently recorded for this domain, though this may reflect a lag in detection rather than an absence of risk.

As of the latest assessment, 14146.xyz remains active and continues to pose a high risk to users. Immediate response actions include blocking the domain at the network level, updating endpoint protection rules, and notifying affected parties of potential exposure. Despite these measures, the domain's persistence and low detection rates on some platforms suggest residual risk. Organizations are advised to monitor for related indicators of compromise, such as the resolving IP address and associated SSL certificate fingerprints, and to educate users on recognizing credential theft tactics.