zuytyarws[.]xin

Analysis of zuytyarws.xin indicates a high-risk phishing domain active as of August 2, 2026. The domain was registered on July 19, 2026, through GNAME.COM PTE. LTD., a registrar frequently associated with newly created fraudulent sites. Infrastructure analysis reveals hosting in Hong Kong under Apex Speed LTD, resolving to IP 103.23.172.15. The nameservers—including a.share-dns.com, a1.share-dns.com, b.share-dns.net, and b1.share-dns.net—are commonly used by threat actors to rapidly deploy and rotate malicious domains.

SSL certification from Let's Encrypt is present, a tactic often employed to lend superficial legitimacy to phishing pages, though it provides no assurance of safety. Detection data further supports malicious classification: the domain appears in five AlienVault OTX threat intelligence pulses and is flagged by 8 of 91 security vendors on VirusTotal. It is also listed on at least one security blocklist and blocked by PhishDestroy. Trust scores from Gridinsoft (1/100) and Scamadviser (15/100) reinforce the high-risk assessment. The site employs Nginx as a web server and supports HSTS and HTTP/3, technologies sometimes used to evade basic detection but not inherently malicious on their own.

No specific brand target or phishing kit has been confirmed in available data, and the exact content of the site remains unanalyzed. However, the combination of recent registration, low-reputation hosting, shared malicious infrastructure, and multiple vendor detections strongly suggests this is an active credential-harvesting or fake login scam. Defenders should treat the domain as compromised and block resolution at the DNS level. Users encountering this domain should avoid interaction, and organizations should monitor for connections to 103.23.172.15 in network logs as a potential indicator of compromise.