lockefel[.]vu

The domain lockefel.vu is flagged as an active generic phishing infrastructure as of the report date, July 22, 2026. It appears on a single security blocklist and has been identified by PhishDestroy as a malicious host. VirusTotal analysis shows that 9 of 91 security vendors have flagged the domain, indicating a measurable detection rate across multiple scanning engines. DNS resolution points to the IP address 104.21.54.162, which is hosted on Cloudflare’s network and is served by the nameservers cecelia.ns.cloudflare.com and paul.ns.cloudflare.com.

Traffic to the domain is delivered over HTTP/3 and incorporates Cloudflare Browser Insights, suggesting the use of Cloudflare’s performance and security services. Front‑end assets reveal the presence of Tailwind CSS and Google Analytics, both of which are common in legitimate sites but can also be leveraged to obscure malicious activity. The domain’s risk level is classified as high, and its status remains active, meaning that the infrastructure continues to be reachable.

At present, no additional intelligence such as registrar details, SSL certificate attributes, page title, or brand targeting is available, leaving those aspects of the campaign unverified. Defensive operators should prioritize immediate blocking of lockefel.vu and its associated IP address at perimeter controls, update intrusion detection signatures to include the observed hostnames, and monitor Cloudflare‑associated traffic for further propagation. Continuous re‑scanning on VirusTotal and inclusion in broader threat‑intel feeds are recommended to capture any evolution in detection metrics or additional associated indicators of compromise.