Analysis indicates that the domain not-reply.us is actively being used for a generic phishing campaign and is classified as high risk. The domain resolves to the IP address 188.114.97.3 and is hosted on Cloudflare infrastructure, as evidenced by its authoritative nameservers mario.ns.cloudflare.com and may.ns.cloudflare.com. Multiple security platforms have taken action against the domain: it is blocked by PhishDestroy, MetaMask, and SEAL, and it appears on three independent security blocklists, reinforcing the view that the domain is malicious.
VirusTotal scans show that two of ninety‑one security vendors have flagged the domain, providing additional corroboration of its threat status. The domain remains active as of the report date, July 28, 2026, and no evidence suggests that the hosting or DNS configuration has changed. Defenders should prioritize immediate containment by adding not-reply.us to network and endpoint blocklists, and consider sinkholing the associated IP address 188.114.97.3 to prevent further credential harvesting.
Continuous monitoring of the domain’s DNS records and any new detections across additional security vendors is advisable, as threat actors may shift infrastructure while maintaining the same domain. Given the confirmed blocklist presence and the limited but consistent vendor detections, the domain should be treated as a confirmed phishing source pending any further investigative updates.