17204[.]xyz

This domain, 17204.xyz, is actively serving a fake login portal designed to harvest user credentials. Analysis indicates the infrastructure is configured to mimic legitimate authentication pages, likely targeting corporate or financial service users. The domain employs social engineering tactics, such as cloned branding and urgent login prompts, to deceive victims into submitting sensitive information. Given the high-risk classification, this campaign poses a significant threat to both individual and organizational security, with potential for credential theft leading to unauthorized account access or secondary attacks. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 04, 2026, through GMO Internet, Inc., a registrar frequently associated with malicious activity. It resolves to the IP address 103.27.177.163 and uses a Let's Encrypt SSL certificate to create a false sense of security. As of the latest assessment, 17 out of 95 security vendors on VirusTotal have flagged 17204.xyz as malicious, with detection labels including "phishing," "fraudulent site," and "credential harvester." The domain remains active and unblocked by many enterprise security solutions, increasing its potential reach. Users who have visited 17204.xyz or entered credentials on the site should immediately take corrective action. First, revoke any sessions associated with the compromised account and change passwords using a trusted device. Enable multi-factor authentication (MFA) if not already active, and monitor the account for suspicious activity, such as unauthorized logins or transactions. If corporate credentials were exposed, notify the organization’s security team to initiate an incident response. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Block the domain and its associated IP (103.27.177.163) at the network level to prevent further exposure.