net-x-world[.]live

Analysis indicates that net-x-world.live is an active phishing domain flagged by multiple security sources as of July 12, 2026. The domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 104.21.2.195. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside a Let's Encrypt SSL certificate. While the page title displayed is 'Just a moment...', this is commonly associated with intermediate or cloaking pages used to filter traffic or evade detection before redirecting victims to malicious content. The domain appears on two security blocklists and is referenced in 23 threat intelligence pulses within AlienVault OTX, suggesting it has been observed in broader phishing campaigns. Six out of 95 security vendors on VirusTotal have flagged net-x-world.live as malicious, reinforcing its classification as a high-risk threat. The domain's trust score of 0/100 further corroborates its association with fraudulent activity. However, the exact nature of the phishing content—such as the targeted brand or specific scam type—remains unconfirmed, as no brand or kit details have been publicly documented in available intelligence. Defenders should treat net-x-world.live as an active threat and implement blocking measures at the network and endpoint levels. Given its use of Cloudflare, organizations may also consider monitoring for connections to the resolved IP address (104.21.2.195) or related infrastructure. While the domain's registration age (less than five months old) and low detection thresholds are consistent with phishing operations, the lack of confirmed brand impersonation or scam category means additional analysis of the live content would be required to determine the precise threat vector. Until further details emerge, this domain should be regarded as a generic credential-theft or data-harvesting phishing site.