filmyfly[.]auction

On 25 July 2026, the domain filmyfly.auction was observed hosting a high‑risk generic phishing infrastructure. The site returns an HTTP 301 redirect and serves a page whose title reads “filmyfly.cymru 2025 South Bollywood”, indicating a likely attempt to lure victims with a Bollywood‑themed lure. The domain resolves to 188.114.97.3, an address owned by Cloudflare (ASN 13335) located in the United States. Cloudflare’s DNS service is used, as shown by the authoritative nameservers devin.ns.cloudflare.com and haley.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that the connection is encrypted with a valid public‑trusted certificate.

The registrar listed is NiceNIC International Group Co., Limited, and the domain was created on 23 February 2026, suggesting a short‑lived registration typical of malicious campaigns. The site appears on one public security blocklist and is actively blocked by PhishDestroy. Scanning on VirusTotal shows three of ninety‑three security vendors flagging the domain, reinforcing the suspicion. Additional heuristics show a Gridinsoft trust score of 0 / 100, a clear indication of malicious reputation. Technology fingerprinting detects PHP execution, Google Analytics, Cloudflare Browser Insights, and HTTP/3 support, all of which are commonly leveraged by threat actors to host dynamic phishing pages while remaining behind a reputable CDN.

What remains uncertain is the exact content delivered after the redirect; no direct analysis of the landing page has been published, and the specific victim‑targeted brand or credential‑capture mechanism is not disclosed in the current intelligence. Defenders should block the domain at network perimeter, add it to URL filtering and DNS sinkhole lists, and monitor for any outbound connections to the associated Cloudflare IP. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection status.