register-flyingtulip[.]xyz

Analysis of register-flyingtulip.xyz indicates a high-risk phishing domain with active infrastructure but currently limited observable malicious content. The domain, registered on March 13, 2026, through Dynadot LLC, resolves to 172.67.187.198 (AS13335, Cloudflare, Inc., US) and is protected by Cloudflare nameservers (aldo.ns.cloudflare.com, arya.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's proxy services. As of July 12, 2026, the domain returns an HTTP 403 status, suggesting access restrictions or a misconfigured phishing kit, while the page title displays a 504 Gateway Time-out error, which may indicate backend issues or deliberate evasion of automated analysis. The domain appears on one security blocklist, and a single vendor flagged it on VirusTotal, though the specific detection context remains unverified. No brand impersonation or scam category is evident from the available data, including the page title or domain name. The use of Cloudflare and HTTP/3 aligns with common phishing infrastructure patterns, where threat actors leverage CDN services to obscure hosting origins and improve resilience. Defenders should treat this domain as suspicious due to its recent registration, Cloudflare proxying, and security vendor detections, even though no active malicious content is currently observable. Monitoring for changes in HTTP status codes, page content, or additional blocklist inclusions is recommended. If the domain is encountered in logs or user reports, it should be blocked or investigated further based on existing indicators.