jefelon[.]cc

Analysis of the domain jefelon.cc indicates an active phishing infrastructure that was registered on February 24, 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED. The domain is delegated to Cloudflare DNS using the nameservers boyd.ns.cloudflare.com and katelyn.ns.cloudflare.com, and resolves to the IP address 188.114.96.3, a Cloudflare edge node. VirusTotal scans have flagged the domain in four out of ninety‑one security engines, demonstrating that multiple independent scanners have observed malicious characteristics.

The domain is listed on one public blocklist and is specifically blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing platform has taken mitigation action. Current WHOIS records show the domain remains active, and no evidence of takedown or remediation has been recorded. No public page title or SSL certificate details have been published, so the exact content served by the site remains unverified.

Defenders should treat jefelon.cc as a high‑confidence phishing indicator: block the domain at perimeter firewalls, DNS resolvers, and proxy filters; add the IP address 188.114.96.3 to network‑wide deny lists, acknowledging that the address may host other unrelated Cloudflare tenants. Continuous monitoring of DNS changes for the domain and its nameservers is advised, as Cloudflare‑hosted domains can be rapidly reconfigured. Security teams should also incorporate the domain’s hash into threat‑intel feeds and correlate any outbound connections from internal hosts to the IP with user activity logs to detect potential credential harvesting attempts.