pc[.]executevip[.]vip

On July 25 2026, analysis of the domain pc.executevip.vip identified it as an elevated‑risk phishing infrastructure that has been taken offline. The domain was registered on 9 June 2025 through Gname.com Pte. Ltd. and resolves to 188.114.96.3, an address owned by Cloudflare (AS13335, United States). Both authoritative nameservers—autumn.ns.cloudflare.com and cory.ns.cloudflare.com—are Cloudflare‑managed, indicating the attacker leveraged Cloudflare’s CDN and DDoS protection services. HTTP traffic was observed over HTTP/3 and the site was built with Vue.js, confirming a modern JavaScript front‑end framework. The page title returned by the server is “Learnfx”, but no further content has been captured because the site is currently offline.

Reputation services consistently flag the host. Gridinsoft assigns a trust score of 0/100, effectively marking the site as malicious. VirusTotal reports that 7 out of 94 scanned engines flagged the domain, reinforcing the suspicion. Independent blocklists have listed the domain on three separate entries, and commercial phishing mitigation platforms PhishDestroy, MetaMask, and SEAL have already blocked access to the site. No public SSL certificate details are available, and the HTTP status code at the time of collection was not recorded due to the offline state.

The evidence points to a deliberately short‑lived phishing operation that likely used a generic “Learnfx” landing page to lure victims, possibly as part of a credential‑ harvesting campaign. However, the exact target brand or credential collection mechanism remains unknown because the page content has not been archived. Analysts should continue to monitor the IP address 188.114.96.3 for any re‑use by other malicious domains, and enforce blocking of pc.executevip.vip at network perimeters and endpoint filters.