luxurybill[.]net

This domain, luxurybill.net, is actively flagged as a high-risk phishing site specializing in the generation of fraudulent payment receipts, as indicated by its page title: 'LuxuryBill - Tạo Fake Bill Chuyển Khoản Chuyên Nghiệp & Nhanh Chóng.' The domain was registered on March 18, 2025, through Cosmotown, Inc., and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (amanda.ns.cloudflare.com and ed.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. The domain lacks an SSL certificate, which is atypical for legitimate financial or transaction-related services, and returns an HTTP 301 redirect status, suggesting it may be rerouting visitors to another malicious endpoint. Security vendors have detected this domain, with 3 out of 95 flagging it as malicious on VirusTotal. It is also blocked by at least one security provider, PhishDestroy, and appears on a security blocklist. The domain's trust score is 0/100, reinforcing its classification as malicious. While the exact content and functionality of the site remain unconfirmed due to the absence of direct analysis, the available evidence—including the page title, registration details, and security vendor detections—strongly indicates its use in facilitating financial fraud through fake payment receipts. Defenders should treat this domain as hostile and implement blocking measures at the network and endpoint levels. Monitoring for connections to 188.114.96.3 or the domain itself is recommended, particularly in environments where financial transactions or payment verification processes occur. Given the domain's reliance on Cloudflare, additional scrutiny of other domains resolving to the same IP or nameserver infrastructure may uncover related malicious activity. No legitimate use case for this domain has been identified, and its continued operation suggests ongoing abuse.