18914[.]xyz

The domain 18914.xyz is currently flagged as a high-risk generic phishing site specializing in credential harvesting. Analysis confirms its active status, with no specific brand impersonation identified at this time. The infrastructure is designed to deceive users into submitting sensitive login credentials, likely for financial fraud or account takeover purposes. Infrastructure analysis reveals the domain was registered through GMO Internet, Inc. on June 10, 2026, and resolves to the IP address 103.27.177.164. Security vendor detections include 19 of 95 flags on VirusTotal, while it appears on two independent security blocklists. The domain holds a Gridinsoft trust score of 0/100, and its SSL certificate is issued by Let's Encrypt, a common tactic among phishing operators to mimic legitimacy. Additional intelligence sources, including AlienVault OTX, have recorded this domain in at least one threat intelligence pulse, further corroborating its malicious intent. Current monitoring indicates 18914.xyz remains operational, posing an ongoing risk to users. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise, and security teams should monitor for connections to 103.27.177.164. User awareness training should emphasize the risks of interacting with unsolicited login prompts, particularly those hosted on newly registered domains with low trust scores. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for all potentially affected accounts.