gftj7[.]pro

Analysis of the domain gftj7.pro, created on February 21 2026, indicates that it was used for a generic phishing campaign before being taken offline. The site returned the page title “Solflare” when accessed, but no further content has been captured. The domain resolves to the IPv6 address 2606:4700:20::ac43:47a7, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. SSL/TLS termination is provided by a GTS CA 1P5 certificate, a common Cloudflare‑issued authority, confirming the use of Cloudflare’s edge network for encryption.

VirusTotal reports that the domain was scanned by 93 vendors; none reported a detection, though the absence of a flag does not constitute evidence of safety. Independent security blocklists have flagged the domain, with PhishDestroy, ScamSniffer, and Enkrypt all listing it as malicious. The domain’s current status is offline, preventing real‑time verification of payloads or credential‑harvesting pages.

Because no additional telemetry such as Safe Browsing verdicts, OTX references, or registrar details were supplied, the investigation relies on the observable network and reputation data. Defenders should continue to block the domain and its associated IPv6 address, monitor for any resurgence of the host under new subdomains, and incorporate the SSL certificate fingerprint into threat‑intel feeds. Ongoing surveillance of Cloudflare‑issued certificates that appear in blocklists is recommended, as the provider’s shared infrastructure can be leveraged by multiple malicious actors.