fuxluck[.]com

Analysis indicates that fuxluck.com is an active generic phishing infrastructure that was taken offline as of the report date. The domain was registered on February 21, 2026 through MAT BAO CORPORATION and is served by Cloudflare DNS using the authoritative nameservers ali.ns.cloudflare.com and jobs.ns.cloudflare.com. DNS resolution points to the IP address 35.240.224.208, which belongs to Google Cloud in the Asia‑Southeast1 region (Singapore). The hosting arrangement suggests the attacker leveraged a reputable cloud provider while obscuring the final service endpoint behind Cloudflare, a common tactic to evade direct attribution.

Security monitoring platforms have identified the domain as malicious: PhishDestroy has blocked it, and it appears on one external blocklist. VirusTotal scans show that four of ninety‑three antivirus engines flagged the domain, providing modest but notable detection across the security community. The Gridinsoft trust score of 0 out of 100 reinforces the poor reputation of the site. Although the exact phishing content and targeted brand are not disclosed in the available intelligence, the classification as generic phishing implies credential harvesting attempts.

Defenders should immediately add fuxluck.com to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare nameservers, and watch for traffic to the Google Cloud IP range 35.240.224.208. Continued vigilance is advised for any newly registered domains using the same registrar or similar naming patterns, as the threat actor may launch replacement sites after takedown. The combination of a recent registration date, low trust score, Cloudflare fronting, and Google Cloud hosting constitutes a high‑confidence indicator of malicious intent requiring proactive mitigation.