fineflix[.]vip

Analysis of fineflix.vip shows a newly registered domain created on 27 February 2026 that was used for a generic phishing campaign before being taken offline. The domain resolves to the IP address 104.21.59.230, which is hosted by Cloudflare, Inc. (AS13335) in the United States. No TLS certificate was observed, indicating that the site operated over plain HTTP. The page title returned by the server is "fineflix", providing no additional context about the targeted brand or service.

VirusTotal recorded a single positive detection out of 95 security vendors, confirming that at least one scanner identified malicious behavior. Google Safe Browsing classifies the URL as a social engineering threat, reinforcing the phishing assessment. The domain is listed on three independent blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive platforms have incorporated the indicator. Registration was performed through Gname.com Pte. Ltd., and the authoritative name servers are carla.ns.cloudflare.com and vasilii.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure.

Current infrastructure status is offline, limiting immediate observation but leaving the underlying IP address reusable for future malicious campaigns. Uncertainty remains regarding the specific phishing lure, payload, or victim targeting, as no further content analysis is available. Defenders should add fineflix.vip to URL filtering rules, enforce blocking of the associated IP 104.21.59.230, and monitor Cloudflare‑hosted traffic for re‑use. Continuous re‑scanning of the domain and its IP is advised to capture any re‑activation, and any inbound connections to the listed nameservers should be scrutinized for anomalous request patterns.