secret-flirts[.]com

Analysis of secret-flirts.com, first observed on 16 July 2026, shows that the domain was created on 16 April 2020 via Name.com, Inc. The authoritative name servers are ns-1237.awsdns-26.org, ns-1653.awsdns-14.co.uk, ns-274.awsdns-34.com and ns-697.awsdns, indicating use of Amazon Route 53 DNS. The domain resolves to 116.203.229.88, an address owned by AS24940 Hetzner Online GmbH in Germany. An HTTPS endpoint is served with a Let’s Encrypt certificate (issuer E7) and the web server reports Nginx with HTTP Strict Transport Security enabled. The HTTP response code is 200 and the page title returned is “Join Us!”. VirusTotal scans have flagged the host in 11 of 93 security engines, and AlienVault OTX contains sixteen threat‑intel pulses referencing the same host.

The domain appears on one public phishing blocklist and is actively blocked by the PhishDestroy sinkhole. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The current operational status is offline, likely as a result of takedown or sinkhole action. While the available metadata confirms the presence of phishing‑related indicators, the specific payload, credential‑collection pages, or targeted brands have not been publicly disclosed.

Consequently, the exact social engineering technique and victim demographic remain uncertain. Defenders should continue to block the domain at network perimeter, update URL filtering rules, and monitor for any re‑registration of the name or reuse of the identified IP space. Correlation of internal logs with the resolved IP and the observed TLS fingerprint can help detect residual activity. Ongoing surveillance of the associated ASN and the listed nameservers is recommended to catch any future infrastructure reuse.