alltayer[.]finance

The domain alltayer.finance was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the hostname resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented a valid SSL certificate identified as WE1, indicating that HTTPS was enabled at the time of observation. Threat intelligence sources have consistently associated the domain with a generic phishing campaign.

AlienVault OTX records list the domain in fourteen separate threat pulses, reflecting repeated reporting by the community. VirusTotal scans returned sixteen positive detections out of ninety‑three security vendors, reinforcing the malicious classification. The domain is also listed on four commercial blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

Although the exact page content, page title, and targeted brand have not been disclosed, the convergence of multiple vendor detections, blocklist listings, and OTX references provides strong confidence that the domain was used for phishing. Defenders should continue to deny any network connections to 188.114.96.3 and add alltayer.finance to local deny lists. Monitoring for re‑registration or new DNS records associated with the same IP range is advised, as threat actors may attempt to resurrect the campaign using fresh domains.