foxphone[.]vip

The domain foxphone.vip is currently active and has been observed supporting a generic phishing operation. Infrastructure analysis indicates that the domain is delegated to Cloudflare DNS, using the authoritative name servers lady.ns.cloudflare.com and matias.ns.cloudflare.com. DNS resolution consistently returns the IPv4 address 188.114.96.3, which belongs to Cloudflare’s edge network and is typical for fast‑flux or content‑delivery configurations used by threat actors. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy sinkhole, demonstrating that at least one defensive entity has identified malicious activity associated with the host.

VirusTotal records show that the domain has been scanned by ninety‑one antivirus engines, none of which produced a detection. The report explicitly cautions that the absence of detections does not constitute proof of benign behavior, and the classification remains a generic phishing threat. No additional reputation data such as Safe Browsing entries, Open Threat Exchange alerts, SSL/TLS certificate details, or HTTP status codes are present in the current intelligence set.

The available evidence does not disclose the specific brand or service being spoofed, nor does it reveal the content of the landing page, the HTTP response, or TLS configuration. Consequently, the exact victim‑targeting technique and the nature of the harvested data remain uncertain. Defenders should treat the domain as hostile, incorporate it into URL filtering, DNS sinkhole, and endpoint protection policies, and block any outbound connections to the IP address 188.114.96.3. Continuous monitoring is advised to detect any changes in DNS resolution, additional blocklist listings, or new detections from future VirusTotal scans. Organizations that have observed traffic to foxphone.