getincreator[.]com

Analysis of getincreator.com shows a newly registered domain (creation date February 23 2026) that was used for an Airdrop‑Scam phishing kit. The domain is hosted on Cloudflare infrastructure (IP 188.114.97.3, AS13335, United States) and uses Cloudflare’s default authoritative nameservers drake.ns.cloudflare.com and lady.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served over plain HTTP or that HTTPS was not configured before the domain was taken offline. The registrar listed is NiceNIC International Group Co., Limited.

VirusTotal scans recorded three positive detections out of ninety‑three security vendors, confirming that at least a subset of commercial scanners identified malicious activity. The domain appears on a single public blocklist, PhishDestroy, which has already taken action to block traffic to the host. No additional threat‑intel sources such as Safe Browsing, OTX, or brand‑specific page titles are available, and the actual landing page content has not been captured.

Given the limited but concrete evidence—registration timing, Cloudflare hosting, absence of TLS, detection by multiple AV engines, and inclusion on an active phishing blocklist—defenders should treat the domain as hostile. Recommended mitigations include adding the domain to DNS‑based blocklists, configuring web‑proxy rules to deny HTTP requests to the IP address, and monitoring for any future re‑registration or similar domains that resolve to the same Cloudflare IP range. Continuous re‑evaluation is advised, as the offline status may change if the operators reactivate the site or shift to a new hosting provider.