register-usefelix[.]xyz

The domain register-usefelix.xyz was registered on March 11, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted behind Cloudflare’s network (ASN 13335). DNS resolution points to IP address 188.114.96.3, which is associated with Cloudflare’s US edge infrastructure. The authoritative name servers are clark.ns.cloudflare.com and kristina.ns.cloudflare.com, both operated by Cloudflare, and the site was delivering content over HTTP/3 using Cloudflare Browser Insights. No TLS certificate was observed, indicating that the site was served without HTTPS encryption at the time of analysis. Public threat intelligence shows that the page title returned by the server is “Felix”.

The domain has been placed on three independent security blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering engines. VirusTotal scanned the domain and recorded nine positive detections out of ninety‑four submitted security vendors, reinforcing the classification as a phishing‑related resource. The domain’s current status is reported as offline, which aligns with the observed lack of an active HTTP response. While the available data confirms the presence of phishing‑related indicators, the specific content that was hosted on the site has not been captured, so the exact phishing lure, credential‑stealing form, or targeted brand cannot be verified. Further forensic capture of the site’s HTTP payload would be required to identify the exact phishing template and any compromised credentials.

Analysts should continue to monitor the domain for any re‑activation, and network defenders are advised to block the domain at perimeter firewalls, DNS resolvers, and endpoint web filters. Because the infrastructure relies exclusively on Cloudflare, blocking the IP address 188.114.96.3 may impact legitimate services that share the same edge node, so domain‑level filtering is preferred.