m[.]eliice[.]vip

Analysis of the domain m.eliice.vip, created on 09 October 2025 and currently active, shows multiple indicators of malicious use. The domain is registered through NameSilo, LLC and uses Cloudflare nameservers boyd.ns.cloudflare.com and nora.ns.cloudflare.com, a configuration commonly leveraged to obscure the true hosting environment. DNS resolution points to the IP address 188.114.96.3, which is associated with Cloudflare's network and does not reveal the underlying server location. VirusTotal has recorded detections from 2 of 91 scanned security vendors, confirming that at least a minority of scanners have identified malicious behavior.

The domain is listed on one public blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the consensus that it is being used for phishing. The threat classification supplied is generic phishing, and the risk rating is high, indicating that the domain is likely employed to harvest credentials or other sensitive information. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or any observed brand targeting, so the specific content served by the site remains unknown. Consequently, defenders cannot confirm the exact phishing vector or the victim demographic.

However, the combination of recent creation, active status, registrar choice, Cloudflare name server usage, IP address, vendor detections, and blocklist inclusion provides sufficient confidence to treat the domain as hostile. Recommended mitigation steps include adding 188.114.96.3 and the fully qualified domain name m.eliice.vip to network deny lists, updating web filtering solutions to block the domain, and monitoring DNS logs for any resolution attempts. Organizations should also consider informing users about the potential for credential harvesting attempts that may originate from this domain.