ssim-guadalajara-gob[.]xyz

Analysis of ssim-guadalajara-gob.xyz indicates that the domain is actively being used for a generic phishing campaign. The domain was registered on July 01, 2026 through DYNADOT LLC and is delegated to the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the single IPv4 address 43.166.217.161, which is the only hosting endpoint observed for this indicator.

The domain appears on one external security blocklist and is presently blocked by the PhishDestroy filtering service, confirming that at least one reputable anti‑phishing feed has flagged the host. VirusTotal has processed the domain with 91 security vendors; 21 of those vendors returned a malicious classification, reinforcing the suspicion of phishing activity. No additional public intelligence such as Safe Browsing entries, Open Threat Exchange reports, SSL certificate details, or HTTP response codes have been disclosed, leaving those aspects of the infrastructure unverified.

The high risk rating assigned to the indicator reflects the combination of recent creation, active hosting, and multiple vendor detections. Defenders should add the domain to internal block or sinkhole lists, monitor DNS queries for the associated IP address, and enforce email gateway rules that quarantine messages containing URLs to this host. Continuous re‑evaluation is advised, as further evidence such as page content, certificate data, or additional vendor detections may emerge.