gumlree[.]form1189[.]cfd

The domain gumlree.form1189.cfd was registered on February 21, 2026 and presently resolves to the IPv4 address 104.21.94.33. That address is owned by Cloudflare, Inc. (AS13335) and is geolocated to the United States. The site is currently taken offline, and the HTTP response returns a generic page with the title “Just a moment…”. The SSL certificate presented for the host is identified as WE1, but no further validation details are available.

Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust. VirusTotal has recorded 14 positive detections out of 93 scanned security vendors, confirming that multiple anti‑malware engines recognize the domain as malicious. The domain appears on one external security blocklist and is specifically listed by PhishDestroy as a phishing source. No additional context such as targeted brand, specific phishing kit, or observed payloads is disclosed in the current dataset.

The combination of a newly‑created domain, Cloudflare‑served IP, low trust score, multiple vendor detections, and inclusion on a dedicated phishing blocklist suggests a high confidence that this domain is being used for a phishing campaign. Defenders should immediately block DNS resolution and HTTP(S) requests to gumlree.form1189.cfd at the network perimeter, update endpoint and web‑gateway filtering rules, and monitor for any residual connections to the associated Cloudflare IP. Because the site is offline, ongoing investigation may be limited; however, threat‑intel feeds should be queried for any related indicators of compromise, and any observed malicious emails or login attempts that reference the domain should be quarantined and analyzed.