s2-floki[.]com

Analysis of s2-floki.com indicates that the domain was created on 19 November 2025 through Dynadot LLC and is currently hosted behind Cloudflare’s network (AS13335). DNS resolution returns the address 172.67.217.105, which is located in the United States and is associated with Cloudflare’s edge infrastructure. The domain is served by Cloudflare’s SSL certificate issued by Google Trust Services (WE1) and supports HTTP/3. Both the A record and the HTTP response are anomalous: an HTTP 404 code is returned for the root path, and the page title that can be retrieved reports a “504: Gateway time‑out”.

The site has been taken offline, and attempts to reach it result in a gateway timeout, which prevents direct observation of any phishing payload. Reputation signals show elevated risk. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 2 of 95 scanning engines flagging the domain as malicious.

The limited detection footprint, combined with the recent registration date and the use of a reputable CDN, matches patterns observed in fast‑flux or throwaway phishing campaigns that rely on short‑lived domains hosted on shared infrastructure. Defenders should proactively deny traffic to 172.67.217.105 at the network perimeter, add s2-floki.com to URL filtering and DNS sink‑hole rules, and monitor for any future re‑registration of the same second‑level domain or similar sub‑domains under the “floki” keyword. Continuous observation of Cloudflare‑related IP ranges for spikes in request volume from internal users can help identify attempted accesses before the domain re‑activates. Because the site currently returns only error pages, threat‑intel teams should treat the domain as a potential phishing vector and keep it on watch lists until further forensic evidence is available.