flow-time[.]fun

This domain flow-time.fun was registered on 2026-02-21 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently listed as offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, indicating that multiple anti‑phishing platforms have identified it as malicious. The page title returned from the site, when it was reachable, reads “Mooner | Airdrop”, matching the declared scam type of a crypto airdrop phishing campaign.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the host. VirusTotal analysis shows that three of ninety‑three security vendors flagged the domain, providing additional independent confirmation of malicious intent. The site is associated with an “Airdrop Scam” phishing kit, which is commonly used to lure victims into submitting cryptocurrency wallet credentials. No TLS certificate was observed, and the HTTP service was reachable without encryption.

Nameservers are frank.ns.cloudflare.com and lola.ns.cloudflare.com, both operated by Cloudflare. While the exact payload and user‑interaction flow have not been publicly released, the combination of blocklist listings, low trust score, flagged vendor detections, and the airdrop‑related page title strongly suggests a targeted crypto‑scam operation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the associated IP, and consider adding the host to internal threat intelligence feeds. Ongoing observation of the IP’s activity and periodic re‑scanning of the domain are recommended to capture any re‑activation attempts.