62ec8a796e[.]nxcli[.]io

Analysis indicates that the domain 62ec8a796e.nxcli.io was created on 5 December 2017 and is currently offline, returning the page title “Site Disabled”. The domain resolves to the IPv4 address 192.190.221.82, which is allocated to AS32244 (Liquid Web, L.L.C.) and geolocated to the United States. Nameserver records point to Cloudflare (adi.ns.cloudflare.com and vicky.ns.cloudflare.com), suggesting the use of Cloudflare’s DNS service for concealment. Registration was performed through Tucows Domains Inc., a registrar that frequently hosts malicious infrastructure. Security‑vendor scanning on VirusTotal recorded nine positive detections out of ninety‑five scanners, indicating that multiple AV engines have identified the domain as malicious.

The domain appears on one external blocklist and is blocked by the PhishDestroy service. Independent trust‑rating services assign extremely low scores: Gridinsoft reports 0 / 100 and Scamadviser 1 / 100, reflecting the consensus that the site is highly untrustworthy. No SSL certificate is present, meaning communications are unencrypted and vulnerable to interception. The intelligence tags the campaign as an “Account Takeover” generic phishing operation. While the page content is not available for further inspection, the combination of low trust scores, multiple vendor detections, and blocklist presence strongly supports the classification.

Uncertainty remains regarding the specific credential‑harvesting mechanisms, the targeted brands, and whether any active command‑and‑control infrastructure is still operational, given the current offline status. Defenders should continue to block the domain and its associated IP address at perimeter and DNS filtering layers. Incident‑response teams encountering related phishing emails should advise users to avoid any credential submission to this domain and to verify URLs against known legitimate services. Ongoing monitoring of the IP 192.190.221.