reallocation-flyingtulip[.]com

Analysis as of July 25, 2026 indicates that the domain reallocation-flyingtulip.com is presently taken offline but retains indicators associated with a generic phishing campaign. The domain was registered on February 24, 2026 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers donald.ns.cloudflare.com and etta.ns.cloudflare.com. DNS resolution points to the address 104.21.63.236, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed, implying the site was served over plain HTTP when active.

The page title returned by the server was “Just a moment…”, a generic placeholder often used by automated landing pages. The domain appears on three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, and has been flagged by three of ninety‑three security vendors on VirusTotal. These detections, combined with the blocklist listings, suggest that threat actors have used the domain for credential‑stealing or similar phishing activities.

Because the site is offline, automated retrieval of the content is not possible, leaving the exact phishing payload and target brand undefined. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address and nameservers, and consider adding the IP to deny‑list rules. Ongoing vigilance is advised in case the infrastructure is repurposed under a new domain or re‑activated, and any future requests to the IP should be logged for forensic correlation.