weblx[.]cc

This domain, weblx.cc, is flagged as a high-risk generic phishing infrastructure targeting user credentials. Analysis indicates no direct brand impersonation, suggesting a flexible credential-harvesting operation likely deployed against multiple targets. The site presents a Cloudflare interstitial page titled 'Suspected phishing site,' which may serve as a cloaking mechanism to evade automated detection while still capturing credentials from redirected victims. No specific drainer kit signatures were identified in initial scans, though the infrastructure aligns with common phishing-as-a-service frameworks observed in recent campaigns. Infrastructure analysis reveals precise technical indicators: the domain resolves to IPv6 address 2606:4700:3033::6815:2d52 (Cloudflare, Inc., AS13335) and was registered on June 30, 2025, through Dominet (HK) Limited. VirusTotal detection ratio stands at 7/95 security vendors, with active blocklist presence on two security feeds (PhishDestroy and ScamSniffer). The SSL certificate is issued under the WE1 authority, a common choice for malicious domains due to its low validation requirements. Google Safe Browsing status remains unconfirmed, but the domain's active blocklist inclusion suggests confirmed malicious activity. Current status shows the domain remains operational with no takedown observed as of seed d5abd4. Response actions should include immediate DNS-based blocking of the domain and its associated IP, alongside monitoring for related subdomains or certificate reuse. Remaining risk is elevated due to the domain's recent registration, Cloudflare hosting (which complicates origin tracing), and low detection rates on major scanning platforms. Users are advised to verify any unexpected login prompts, particularly those redirecting to weblx.cc or similar domains, and report suspicious activity to their security teams for further analysis.