14091[.]xyz

Analysis on 14091.xyz as of July 21, 2026 indicates the domain is actively used in a generic phishing campaign. The domain was registered through Dynadot Inc on May 11, 2026 and is served by the authoritative name servers a.share-dns.com, a8.share-dns.com, b.share-dns.net, and b8.share-dns.net. DNS resolution returns the IPv4 address 103.27.177.163, which is the only observed host for the domain. VirusTotal has recorded nine positive detections out of ninety‑five scanned security vendors, confirming that multiple commercial scanners have identified malicious activity associated with the domain. The domain currently appears on one public security blocklist and is explicitly listed by the PhishDestroy blocklist, reinforcing its classification as high‑risk. The risk level assigned by the reporting system is high and the operational status is active, meaning the infrastructure remains reachable. No public evidence regarding SSL/TLS certificate details, HTTP response codes, page title, or content has been disclosed, so the exact phishing landing page cannot be described at this time. Likewise, information on associated threat‑intel feeds such as OTX, Safe Browsing, or additional blocklist memberships is not present in the available data. The absence of these details does not imply benign behavior; rather, it reflects a current gap in public observations. Defenders should block or sinkhole traffic to 14091.xyz at the network perimeter, add the domain and its resolving IP address 103.27.177.163 to existing URL filtering and DNS blacklist policies, and monitor for outbound connections from internal hosts to the listed name servers. Because the domain is newly created (May 11, 2026) and already flagged by multiple vendors, rapid containment is advised. Continuous re‑evaluation is recommended as further intelligence, such as page content or additional blocklist listings, becomes available.