8l8[.]org

Analysis of 8l8.org indicates a high‑risk generic phishing operation that remains active as of July 12 2026. The domain was registered on February 21 2026 and resolves to IP 109.234.160.89, located in France and owned by AS50474 O2SWITCH SAS. The host serves a WordPress site (PHP, MySQL) with the All in One SEO plugin and presents an HTTPS certificate issued by Let’s Encrypt (R12). HTTP requests return status 200 and the page title is reported simply as “8l8 –”. Infrastructure signals include nameservers ns1.o2switch.net and ns2.o2switch.net. Threat intelligence shows the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Four of ninety‑three VirusTotal scanners have raised alerts, and a Gridinsoft trust score of 0 out of 100 further corroborates malicious intent. No additional content analysis is available, so the specific phishing lure or targeted brand cannot be confirmed at this time. Defenders should treat 8l8.org as a malicious phishing resource, enforce network‑level blocking, monitor DNS queries for the associated IP, and consider adding the domain to internal blacklists. Ongoing observation is advised to detect any changes in hosting or payload delivery.