detranmt[.]xyz

This report documents the domain detranmt.xyz, which is currently under investigation for generic phishing activity as of July 25, 2026. Analysis confirms that the domain remains active and is resolving to IP address 172.67.187.58. The domain was registered through NameSilo, LLC on July 24, 2026, indicating recent setup of the infrastructure. Nameserver configuration points to charles.ns.cloudflare.com and simone.ns.cloudflare.com, suggesting the use of Cloudflare services for DNS management and potential content protection.

Detranmt.xyz is present on one known security blocklist, specifically flagged by PhishDestroy. The domain has been scanned by 91 security vendors on VirusTotal, with none currently flagging it. However, the absence of detections does not confirm the domain is safe, as blocklist inclusion by PhishDestroy provides direct evidence of suspicious or malicious activity. No additional threat intelligence is available regarding Safe Browsing, OTX, ASN, hosting provider, SSL status, HTTP response, page title, or trust scores. The exact website content and potential brand targeting have not yet been analyzed.

Given the recent domain creation and immediate blocklisting, defenders should treat detranmt.xyz as suspicious, monitor for connections to the associated IP address, and block access at the network perimeter where appropriate. Continued observation is recommended until further evidence clarifies the nature and scope of the threat. Investigation into related infrastructure and potential phishing campaigns leveraging this domain is ongoing.