18091[.]xyz

The domain 18091.xyz is currently identified as a generic_phishing threat and remains active. There is no specific brand impersonation noted, but the domain exhibits characteristics typical of phishing campaigns, including a recent creation date and a low trust score.

Analysis of 18091.xyz reveals that it has been flagged by 9 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion within the cybersecurity community. The domain resolves to the IP address 154.39.104.130 and is registered through GMO Internet, Inc. It was created on June 28, 2026, which is a relatively recent registration, often a red flag for malicious activity. The SSL certificate is issued to Default Company Ltd, which is a generic and unverifiable entity, further raising concerns about the legitimacy of the domain. Additionally, the domain appears on 1 security blocklist, suggesting it has been involved in or suspected of malicious activities.

Given the current active status of 18091.xyz and the multiple indicators of a generic_phishing threat, it is recommended that users avoid interacting with this domain. Network administrators should consider adding this domain to their blocklists to prevent access. Regular monitoring of security feeds and updates to threat intelligence databases can help in identifying and mitigating risks associated with this and similar domains. Organizations should also conduct user education on common phishing tactics and encourage reporting of any suspicious emails or web activities.