17901[.]xyz

This domain, 17901.xyz, operates as a credential-harvesting phishing site targeting users through fake Microsoft login portals. Victims are lured into entering account credentials, which are then captured and transmitted to threat actors. The site may also deploy secondary payloads, such as browser-based crypto drainers or malware, under the guise of authentication errors or security updates. The threat extends beyond immediate credential theft, as compromised accounts can be leveraged for further attacks, including business email compromise (BEC) or unauthorized access to cloud services. Analysis indicates this domain was registered on June 28, 2026, through GMO Internet, Inc., a registrar frequently abused for phishing operations. It resolves to the IP address 103.27.177.164 and is flagged by 15 out of 95 security vendors on VirusTotal, with detections including generic phishing and brand impersonation. The infrastructure employs Cloudflare for traffic obfuscation, Nginx as a web server, and Vue.js for dynamic content rendering. Additional technical indicators include the use of Let's Encrypt SSL certificates, HTTP/3 protocol support, and HTTP Strict Transport Security (HSTS) headers, which are often exploited to lend false legitimacy to malicious sites. If you or a user on your network visited 17901.xyz and entered credentials, take immediate action. First, revoke access to the affected account by resetting passwords and enabling multi-factor authentication (MFA) where available. Review the account for unauthorized activity, including sent emails, file modifications, or login attempts from unfamiliar locations. Check connected devices for signs of malware, particularly browser extensions or scripts that may have been installed during the session. If financial or cryptocurrency data was entered, monitor linked accounts for unauthorized transactions and report suspicious activity to the relevant platform. Network administrators should block the domain and its resolving IP (103.27.177.164) at the firewall or DNS level to prevent further exposure.