ostlulm[.]click

Analysis of ostlulm.click shows a newly created domain (registered 21 Dec 2025 via Dynadot LLC) that resolves to 104.21.87.46, an IP owned by Cloudflare (AS13335). The domain is served through Cloudflare’s network, uses HTTP/3, and presents a Google Trust Services / WE1 SSL certificate, yet the public page returns a Cloudflare 521 error with the title “ostlulm.click | 525: SSL handshake failed,” indicating that the origin server is unavailable or mis‑configured. VirusTotal records three detections out of 93 scanners, and Gridinsoft assigns a trust score of 0 / 100, reinforcing suspicion. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, reflecting a high‑risk classification. While the exact phishing payload or targeted brand cannot be confirmed due to the inaccessible page, the infrastructure—short‑lived domain, Cloudflare front‑end, and low trust scores—aligns with typical generic phishing setups. Defenders should immediately block ostlulm.click at perimeter and DNS layers, monitor for any look‑alike registrations, and ensure that outbound traffic to the resolved IP is restricted. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this domain.