118scalemodels[.]top

Analysis of the domain 118scalemodels.top, first seen on the day it was registered (2026-07-22), shows that it is currently active and resolves to the IPv4 address 23.227.38.65. The domain is hosted on Cloudflare infrastructure, as indicated by the authoritative name servers james.ns.cloudflare.com and magdalena.ns.cloudflare.com. Registration was performed through NameSilo, LLC, a registrar that frequently appears in malicious-hosting investigations. The domain has been added to a single security blocklist and is already being filtered by the PhishDestroy feed, suggesting that at least one defensive organization has observed malicious use.

VirusTotal reports that the domain was examined by 95 scanning engines; none of those engines raised a detection at the time of analysis. While the lack of detections does not confirm benign intent, it indicates that the payload or hosting characteristics have not yet triggered known signatures. The classification of “generic phishing” derives from the threat taxonomy applied by the reporting system, but no public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact phishing vector undefined.

Consequently, the primary uncertainty concerns the content delivered to victims and whether the site is actively harvesting credentials. Defenders should continue to block 118scalemodels.top at network perimeters, monitor DNS queries for the associated IP address, and consider adding the domain to internal blocklists. Ongoing observation of traffic to the Cloudflare name servers and periodic re-scans on VirusTotal are recommended to detect any future changes in malicious behavior.