letssendit[.]fun

letssendit.fun is a newly registered domain (creation date 21 Feb 2026) that was observed hosting a generic phishing campaign. The domain resolves to the IP address 66.241.125.237, which belongs to Fly.io, Inc., a US‑based cloud hosting provider. DNS resolution is served by three nameservers under the udag hierarchy (ns.udag.de, ns.udag.net, ns.udag.org), and the registrar listed is united‑domains GmbH. The site’s HTML title is “let's send it”, but no further content analysis is available because the service was taken offline prior to this investigation. Threat intelligence correlates the domain with one AlienVault OTX pulse, indicating that it has been shared within a known threat feed.

Commercial detection services have flagged the domain on VirusTotal, where six of ninety‑three scanners reported malicious behavior. The domain also appears on a single public blocklist and has been actively blocked by the PhishDestroy sinkhole network. No additional public reputation or Safe Browsing verdicts were recorded. The technical stack identified through passive fingerprinting includes Node.js, React, Next.js, Webpack and the Fly.io deployment platform, suggesting the actors leveraged a modern JavaScript framework to host the phishing page. Twitter Ads were also detected, implying that the campaign may have used paid social media promotion to drive traffic.

No SSL certificate details, HTTP response codes, or content hashes were captured before the takedown. Uncertainty remains around the exact phishing payload, the targeted brand or credential type, and whether the infrastructure has been reused for other campaigns. Analysts should monitor the associated IP address and the registrar’s future registrations for similar patterns, add the domain to internal blocklists, and continue to query VirusTotal and OTX for any new detections.