trasvilox-fr[.]net

The domain trasvilox-fr.net was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States. No TLS certificate is present for the host, indicating that the site does not serve encrypted traffic. VirusTotal has recorded 16 detections out of 93 scanned security vendors, confirming that multiple AV engines consider the domain malicious.

The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing infrastructure. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, further supporting the malicious assessment. The authoritative name servers are hank.ns.cloudflare.com and rosemary.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. Current monitoring shows the domain is taken offline, but the historical evidence suggests it was used for a generic phishing campaign before being shut down.

Defenders should continue to block the domain and its associated IP address across perimeter and endpoint controls, update any URL filtering policies to include the observed blocklist entries, and monitor for any future re‑registration or similar domains using the same registrar or Cloudflare name servers. Because the site lacks HTTPS, any attempted connections would be unencrypted, simplifying detection through network inspection. No additional intelligence such as page titles or payload samples is available, so the assessment relies solely on the infrastructure and vendor signals described.