neonflix[.]xyz

Analysis indicates that neonflix.xyz carries multiple threat indicators consistent with generic phishing operations. The domain registers a Gridinsoft trust score of 5 out of 100 and appears on one security blocklist while remaining listed in eight AlienVault OTX pulses. VirusTotal reports flag the domain from three out of 95 vendors. It is also blocked by PhishDestroy and maintains an active HTTP 200 status with a page title matching the domain itself. These metrics establish a high-risk classification that aligns with the recorded threat type.

Infrastructure analysis reveals that the domain resolves to IP address 103.224.212.216 located in Australia and uses nameservers ns15.abovedomains.com and ns16.abovedomains.com. The SSL certificate was issued by Let's Encrypt under the R12 profile, and registration occurred through Communigal Communications Ltd on April 28 2026. The two-and-a-half-month age of the domain combined with the shared nameserver infrastructure commonly observed in short-lived campaigns supports the observed risk level without introducing external assumptions.

Several elements remain uncertain because additional context on content behavior or downstream redirection patterns is unavailable from current telemetry. The precise payload delivery mechanism and any associated actor attribution fall outside the recorded data points. Continued monitoring is required to determine whether the site evolves its structure or resolves to new endpoints.

Defenders should implement DNS-level blocks against both the domain and its current IP address while updating firewall rules to deny traffic to 103.224.212.216. Security teams are advised to cross-reference incoming URLs against the existing blocklist entries and AlienVault pulses to reduce exposure. Regular re-evaluation of the nameserver pair is recommended given the domain's active status.