flirtmailers[.]com

The domain flirtmailers.com is currently classified as a high‑risk generic phishing site. The registration date of 26 February 2026 and the active status indicate recent deployment. DNS resolution points to the IPv4 address 35.214.207.252, which is advertised by AS19527 and geolocated to the Netherlands. An HTTP 302 response is observed, and the TLS certificate is issued by Let’s Encrypt (R13), confirming the use of encrypted connections.

Infrastructure analysis reveals that the site is hosted on a platform identified by Nginx web‑server software and a hosting environment associated with SiteGround. Nameservers ns1.siteground.net and ns2.siteground.net resolve the domain. The mail exchange record is set to mx.plingest.com with priority 10, suggesting a third‑party mail service. The Gridinsoft trust score is 0 out of 100, and the domain appears on two public phishing blocklists (PhishDestroy and PhishingDB).

Threat‑intel aggregators flag the domain heavily: VirusTotal records 13 out of 95 security vendors as malicious, and AlienVault OTX cites the domain in 17 separate threat pulses. The page title returned from the server is “Match Notifier”, which does not disclose the targeted brand or lure type, leaving the exact phishing narrative unknown. The combination of a low trust score, multiple vendor detections, and blocklist presence supports the high‑risk rating.

Defenders should block both the domain name and its resolving IP address at network perimeters and update email security gateways to reject messages routed through mx.plingest.com when associated with this domain. Continuous monitoring of the IP range assigned to AS19527 is advised, as the infrastructure could be repurposed for additional campaigns. Because the visual content of the landing page has not been captured, analysts should treat any user‑initiated interaction with the site as potentially malicious until further forensic evidence is obtained.