quixel[.]info

The domain quixel.info has been identified as part of an active phishing operation as of July 27, 2026. This domain currently resolves to IP address 104.21.14.187 and is configured with nameservers cloe.ns.cloudflare.com and koa.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services for traffic management and potential obfuscation of backend infrastructure. Registration records show that the domain was created on May 14, 2026, through Sav.com, LLC, a registrar frequently used in automated domain provisioning. The domain’s status remains active at the time of this assessment.

Threat intelligence sources provide multiple indicators of malicious activity. One major security vendor, PhishDestroy, currently blocks access to quixel.info, and the domain appears on at least one recognized security blocklist. VirusTotal analysis reports that 1 out of 91 vendors have flagged this domain for suspicious or malicious behavior, suggesting that while broad detection is not yet widespread, there is direct evidence of phishing-related activity. No further details about the website's specific content, branding, or targeted organizations are available at this time, and there is no evidence regarding its SSL certificate status, HTTP response, or trust score.

Given these factors, defenders should treat quixel.info as a high-risk domain and block it at the network and email gateway levels. Continuous monitoring is recommended to detect any associated infrastructure or further threat campaigns. Since the domain remains active and is already known to some security vendors, defenders should ensure that their security solutions are updated to include this threat. Further investigation into related IPs and domains is advised to identify additional components of the phishing infrastructure.