89461[.]xyz

The domain 89461.xyz has been identified as a high-risk credential theft site and is currently active. The analysis indicates that this domain is being utilized for fraudulent purposes, likely to collect sensitive user information under false pretenses.

Specific data reveals that 89461.xyz was flagged by 9 of 95 VirusTotal vendors, indicating notable recognition of its malicious intent. The domain was registered through Gname.com Pte. Ltd. on January 31, 2026, and is actively resolving to the IP address 103.27.177.163. The domain has a low trust score, with a blocklist count reflecting its ongoing malicious activities. The infrastructure analysis shows that the site employs technologies such as Vue.js and Nginx, as well as HSTS and Cloudflare, suggesting an advanced setup to evade detection and maintain uptime.

Current status indicates that 89461.xyz remains operational, posing a significant risk to potential victims. It is recommended that users exercise caution and refrain from interacting with this domain. Security professionals and system administrators should consider implementing blocklists that include this domain and monitor network traffic for any indicators of compromise associated with the IP address 103.27.177.163.