f219c[.]xyz

Analysis of the domain f219c.xyz indicates it is a phishing infrastructure that was active until recently and is now offline. The domain was registered on January 6, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with low-reputation registrations. Its nameservers, A.SHARE-DNS.COM and B.SHARE-DNS.NET, are commonly used by threat actors to host malicious or disposable domains. As of the latest assessment on July 23, 2026, the domain is no longer resolving, which may indicate takedown or evasion.

Security vendors have flagged this domain: 15 out of 93 engines on VirusTotal detected it as malicious, though the exact nature of the threat remains unconfirmed due to the lack of page content analysis. The domain appears on at least one security blocklist, specifically PhishDestroy, and is referenced in two AlienVault OTX threat intelligence pulses, suggesting prior malicious activity. The page title, 'f219c.xyz,' offers no clear indication of the intended brand or target, and no specific phishing kit or campaign has been attributed to this domain in available data. Defenders should treat this domain as a confirmed phishing threat based on its detection history and infrastructure.

While the site is currently offline, monitoring for re-registration or re-emergence under similar nameservers or registration patterns is recommended. Historical DNS and WHOIS records should be preserved for forensic purposes, and any associated IPs or certificates should be cross-referenced with other known malicious infrastructure. Given the elevated risk classification, blocking or alerting on this domain in security controls is advised until further evidence confirms its deactivation or remediation.