a131c[.]xyz

PhishDestroy identifies a131c.xyz as an active high-risk domain designed to impersonate a legitimate login portal for credential theft. The site leverages a recently registered domain (March 16, 2026) and a Let’s Encrypt SSL certificate to appear authentic. Infrastructure analysis reveals the domain resolves to 154.39.104.140 and was registered via Gname.com Pte. Ltd., a registrar often associated with malicious registrations.

This domain has been flagged by 11 out of 95 VirusTotal security vendors, indicating widespread detection of its malicious nature. Its recent creation date and active status further underscore its use in current phishing campaigns. The combination of a freshly registered domain, low-cost hosting, and SSL certification creates a deceptive façade that can fool even cautious users.

If you visited a131c.xyz, immediately change any passwords entered and review your accounts for suspicious activity. Use a reputable password manager to clear cached credentials. Report the domain to your security team or platform provider and scan your device with updated antivirus tools. Avoid interacting with this site in the future, as it remains active and poses an ongoing threat to user data.