pc[.]executefavip[.]vip

The domain pc.executefavip.vip was registered on June 30, 2025 through Gname.com Pte. Ltd. and is currently taken offline, returning an HTTP 503 status code. Infrastructure analysis shows the domain resolves to IP 104.21.52.223, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The authoritative nameservers are autumn.ns.cloudflare.com and cory.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The site’s page title was observed as “Learnfx,” and technology fingerprints reveal Ant Design, Vue.js, Cloudflare, and HTTP/3, consistent with a modern web‑application stack.

Reputation signals are strongly negative: the domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. VirusTotal scans report that five of ninety‑four security vendors flagged the domain, providing independent confirmation of suspicious activity. Although the page title suggests a possible impersonation of a service named Learnfx, no additional evidence about the targeted brand or the exact phishing content has been disclosed.

Defenders should add pc.executefavip.vip to network‑level deny lists, enforce DNS filtering, and monitor for any re‑hosting attempts on alternative IP ranges. Continuous threat‑intel feeds should be consulted for updates, and any inbound traffic to the domain should be logged and investigated for potential credential harvesting attempts. The combination of blocklist presence, low trust score, and confirmed vendor detections makes the domain a high‑confidence indicator of phishing infrastructure that warrants immediate remediation.