baysnowballcoin[.]xyz

Analysis indicates that the domain baysnowballcoin.xyz was registered on December 19, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to IP address 104.21.60.74, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, suggesting the site is served over plain HTTP. The page title returned by the server is “Um momento…”, a generic placeholder that provides no indication of the intended victim target. VirusTotal has recorded detections from six of ninety‑five scanned security vendors, confirming that multiple AV engines flag the domain as malicious.

The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, reinforcing its classification as a phishing‑related resource. AlienVault Open Threat Exchange (OTX) references the domain in three separate threat‑intel pulses, indicating that it has been observed in multiple campaigns. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The current operational status is offline, and the site is not serving content at the time of analysis.

Defenders should continue to block the domain at network perimeter and DNS layers, incorporate the IP address 104.21.60.74 into threat‑intel feeds, and monitor for any resurgence of activity. Because the site lacks an SSL certificate and the page title offers no further clues, the specific brand or service being spoofed remains unknown. Ongoing observation of the associated IP range and Cloudflare‑hosted domains is recommended to detect potential re‑use of the infrastructure. The combination of multi‑vendor detections, blocklist listings, low trust score, and OTX pulse references justifies an elevated risk rating and warrants inclusion in incident response playbooks targeting generic phishing campaigns.