65254[.]xyz

Analysis of 65254.xyz shows a high‑risk, active generic phishing infrastructure. The domain was registered on March 22, 2026 through Gname.com Pte. Ltd., and it uses the nameservers a.share-dns.com, a7.share-dns.com, b.share-dns.net, and b7.share-dns.net. DNS resolution points to the IPv4 address 103.244.148.113, which is the sole host observed for this campaign. The domain appears on two public blocklists, specifically PhishDestroy and OpenPhish, confirming that external threat‑intel feeds have already flagged the site.

VirusTotal scans have returned detections from 12 of 91 security vendors, indicating that a subset of industry‑wide scanners recognize malicious behavior associated with the domain. The threat is classified as generic phishing, and the risk level is set to high. Current status remains active, meaning the domain is still resolving and likely serving malicious payloads or credential‑harvesting pages. What is not yet known includes the exact content of the hosted pages, any SSL certificate details, and whether the IP address is shared with other malicious actors.

Defenders should prioritize immediate blocking of 65254.xyz at perimeter security controls, DNS filtering solutions, and proxy devices. Continuous monitoring of the associated IP address for new activity, as well as periodic re‑scanning of the domain on VirusTotal or similar platforms, is recommended to capture any changes in detection coverage. Integration of the domain and its IP into threat‑intel feeds used by SIEM and EDR systems will help surface related indicators of compromise in the future.