accounts[.]carlilex[.]com

Analysis indicates that accounts.carlilex.com is actively leveraged for credential phishing targeting social media accounts. The domain was registered on May 08 2025 through NameCheap, Inc., and is hosted behind Cloudflare’s AS13335 network, resolving to 172.67.212.88. The SSL certificate is issued by Google Trust Services under the WE1 root, which supplies a valid TLS handshake but does not mitigate the malicious intent. Threat intelligence aggregators have identified the domain on multiple blocklists: Google Safe Browsing classifies it as social engineering, PhishDestroy has listed it as blocked, and it appears on one additional security blocklist.

VirusTotal reports that 14 of 93 scanned security vendors flag the domain as malicious, reinforcing the suspicion. The infrastructure utilizes Cloudflare’s DNS services with the authoritative nameservers diva.ns.cloudflare.com and keenan.ns.cloudflare.com, and the site serves over HTTP/3, a typical configuration for fast‑response phishing pages. The domain is currently offline, which may be a temporary takedown or a rotation tactic. Uncertainty remains regarding the exact phishing landing page content, as no page title or visual analysis is available.

Defenders should immediately add accounts.carlilex.com to DNS sinkhole or firewall block lists, monitor for any resurgence of the host IP or associated Cloudflare IP ranges, and enforce strict email filtering for messages referencing the domain. Continuous observation of NameCheap registration activity and Cloudflare name‑server changes is recommended to detect potential re‑registration or migration to alternative hosting. Given the confirmed multi‑vendor detection and blocklist entries, the domain should be treated as high‑risk and excluded from trusted web traffic.