ygkjxahmofxmlvazmwihs[.]xyz

PhishDestroy identifies an active credential-harvesting campaign hosted at ygkjxahmofxmlvazmwihs.xyz. The domain is designed to impersonate a legitimate login portal and trick users into surrendering usernames and passwords. Traffic is routed through IP 104.21.20.148 and secured with a Let’s Encrypt certificate to appear trustworthy. This domain was flagged by 6 out of 95 VirusTotal security vendors on first submission and is registered via NICENIC INTERNATIONAL GROUP CO., LIMITED with a creation date of April 19, 2026. The low but non-zero detection rate suggests the page is newly deployed and still evading many signature-based defenses. If you visited ygkjxahmofxmlvazmwihs.xyz and entered any credentials, immediately change those passwords on a clean device and enable multi-factor authentication where available. Scan the endpoint with an updated antivirus suite, check browser extensions for anomalies, and review financial statements for unauthorized transactions. Report the domain to your security team or the appropriate anti-phishing clearinghouse to help block further abuse.