cars-excellent[.]com

Analysis of cars-excellent.com shows a recently registered domain (creation date July 20, 2026) that resolves to the IP address 188.114.97.3. The domain is hosted on Cloudflare infrastructure, as indicated by its authoritative name servers ivan.ns.cloudflare.com and paloma.ns.cloudflare.com. It is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that threat intelligence feeds consider it malicious.

The registrar listed for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known registrar that has been used for malicious registrations in other campaigns. VirusTotal scanned the domain with 91 antivirus and URL‑reputation vendors; none reported a detection, but the absence of detections does not constitute evidence of safety given the domain’s active blocklist status and recent creation. No public information about the site’s page title, SSL certificate, HTTP response codes, or visual content is currently available, leaving the exact phishing payload and targeted brand undefined.

Defenders should treat the domain as a high‑confidence phishing indicator: add the fully qualified domain name to outbound and inbound web filtering rules, ensure DNS resolvers block queries to the domain, and monitor for any related C2 traffic to the hosting IP. Continuous re‑evaluation is advised, as additional intelligence (e.g., page content analysis or detection by additional vendors) may emerge that clarifies the impersonated brand or the specific data being harvested.