flyntigulip[.]mom

Analysis of flyntigulip.mom shows a newly registered domain (created 21 Feb 2026) that was hosted on Cloudflare’s network (ASN 13335) and resolved to 172.67.149.108 in the United States. The domain uses Cloudflare’s default nameservers (kate.ns.cloudflare.com, west.ns.cloudflare.com) and does not present an SSL certificate, leaving HTTP connections unencrypted. Page metadata reports the title “Flying Tulip”, which does not reference the targeted brand but the domain is listed as impersonating Ethereum. The observed scam type is “Wallet/Seed Phishing”, indicating an attempt to harvest private keys or seed phrases.

Reputation services flag the site heavily: the Gridinsoft trust score is 0 / 100, and the domain appears on four independent blocklists (PhishDestroy, MetaMask, ScamSniffer, SEAL). VirusTotal analysis returned three positives out of ninety‑three scanners, confirming malicious classification by multiple engines. The registrar is PublicDomainRegistry.com operating under PDR Ltd. The domain has been taken offline as of the reporting date, but historical activity remains relevant for threat‑intelligence correlation. Defenders should continue to block the domain at network perimeter, monitor for any residual traffic to the Cloudflare IP, and add the domain hash to endpoint detection rules.

Because the site lacked HTTPS, any credential capture would have occurred over cleartext, emphasizing the need to enforce TLS‑only policies for web traffic. Indicators such as the exact IP address, nameserver set, and blocklist entries should be incorporated into SOC enrichment pipelines. Further investigation is limited by the offline status; no additional payload or page content has been captured, so analysts should treat the current indicators as the complete set of observable evidence.