register-tuna[.]fun

On 25 July 2026, the domain register-tuna.fun was observed as part of a generic phishing infrastructure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network, resolving to the IPv4 address 104.21.33.112, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by the Cloudflare name servers kara.ns.cloudflare.com and terry.ns.cloudflare.com. No TLS certificate is presented; HTTP requests receive a generic page whose title is “Just a moment…”, indicating that the site is likely serving a placeholder or redirect script rather than a legitimate login portal.

The site has been taken offline, and mitigation services such as PhishDestroy have reported it as blocked. Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis recorded a single positive detection out of ninety‑five scanned vendors, confirming that at least one security product flagged the domain as malicious. The lack of a valid SSL certificate, combined with the low trust score and the positive VirusTotal flag, suggests the domain was being used to host phishing content, although the exact target brand or credential‑harvesting page has not been disclosed.

Defenders should continue to monitor DNS queries for register‑tuna.fun and its associated IP address, enforce blocklists that include this domain, and consider adding the IP 104.21.33.112 to network‑level deny lists, especially for traffic originating from Cloudflare‑served zones. Because the site is currently offline, any ongoing campaigns may have migrated to alternative infrastructure; threat‑intel teams should watch for similar domains registered by the same registrar or using the same Cloudflare name servers.