filezillas[.]com

Analysis of filezillas.com shows a high‑risk, active generic phishing infrastructure. The domain was registered on June 8 2026 through Vantage of Convergence (Chengdu) Technology Co., Ltd. DNS resolution points to IP 43.155.165.235, an address hosted by Tencent Cloud Computing in South Korea. The web server is identified as Nginx with HTTP Strict Transport Security and HTTP/3 enabled, and the TLS certificate is issued by Let’s Encrypt (R12). HTTP responses return a 301 redirect; the page title is a garbled string that does not reveal the intended content. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Threat intelligence sources report four AlienVault OTX pulses referencing the host, and VirusTotal scans show 16 of 91 security vendors flagging the domain. The evidence points to a deliberately crafted phishing site, likely used to lure victims seeking FileZilla client software. Uncertainties remain regarding the exact payload or credential‑collection mechanisms, as the page content has not been fully analysed. Defenders should add the domain and its IP to deny‑list controls, monitor DNS queries for related look‑alike domains, and ensure endpoint security solutions are updated to recognize the observed indicators. Continuous feed ingestion from blocklists and OTX will aid in early detection of any expanded campaign activity.