register-larpball[.]fun

This domain, register-larpball.fun, was registered on February 21, 2026, through NiceNIC International Group Co., Limited and is currently offline. Infrastructure analysis reveals it resolved to 188.114.97.3, a Cloudflare IP (AS13335) located in the US, and used Cloudflare nameservers (rafe.ns.cloudflare.com, skip.ns.cloudflare.com). No SSL certificate was detected. The page title captured during active monitoring was 'Just a moment...', a default Cloudflare interstitial that often appears before a phishing landing page loads, though the exact content of the site remains unconfirmed. Detection data is limited but indicative of malicious intent.

The domain appears on one security blocklist and was flagged by a single vendor on VirusTotal. PhishDestroy has also blocked this domain. While the low detection count does not rule out malicious activity, the combination of Cloudflare hosting, lack of SSL, and the 'Just a moment...' page title suggests a recently deployed phishing site that may not yet have been widely distributed or detected. The domain’s offline status as of July 25, 2026, could indicate takedown action or temporary deactivation by the threat actor. Defenders should treat this domain as suspicious based on its infrastructure and detection history.

Network-level blocking is recommended for organizations, particularly those using PhishDestroy or similar security tools. If logs indicate prior connections to this domain, review for signs of credential theft or follow-on compromise. Given the use of Cloudflare, defenders should also monitor for related domains using the same nameservers or IP range, as threat actors often reuse hosting providers for phishing campaigns. No brand or specific scam type has been confirmed, so generic phishing defenses should be applied.