18754[.]xyz

Analysis of the domain 18754.xyz shows that it was registered through GMO Internet, Inc. on 10 June 2026. The domain is currently active and resolves to the IPv4 address 103.244.148.113. DNS resolution is served by four name servers (a.share-dns.com, a9.share-dns.com, b.share-dns.net, b9.share-dns.net), a configuration commonly observed in malicious hosting setups that employ shared DNS infrastructure to obscure attribution.

Reputation data indicate that 18754.xyz appears on two public phishing blocklists and is actively blocked by PhishDestroy and OpenPhish. VirusTotal has recorded detections from 16 of 91 security vendors, reinforcing the classification of the domain as a phishing resource. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or observed brand impersonation is presently available, limiting the ability to describe the exact payload or targeted victims.

The convergence of recent registration, shared DNS, multiple vendor detections, and inclusion on dedicated phishing blocklists suggests a high likelihood that the domain is being used for credential harvesting or similar credential‑stealing campaigns. Defenders should add 18754.xyz to web‑filtering and DNS‑sinkhole policies, monitor network traffic for connections to 103.244.148.113, and enforce multi‑factor authentication for accounts that could be targeted. Continuous observation of the domain’s DNS records and any future VirusTotal or sandbox submissions is recommended to capture changes in payload or hosting infrastructure.