fly16aa[.]com

fly16aa.com is a newly observed malicious site first registered on August 30, 2024 through Name.com, Inc. The domain resolves to IP address 104.21.22.39, which belongs to AS13335 operated by Cloudflare, Inc. The hosting infrastructure is protected by Cloudflare’s DNS service, using the nameservers bella.ns.cloudflare.com and hayes.ns.cloudflare.com, and supports HTTP/3. An SSL certificate issued by Google Trust Services (subject WE1) is present, but the site returns HTTP status 526, indicating an invalid SSL configuration.

The domain appears on one public security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis records 2 of 95 scanned security vendors flagging the domain, reinforcing its classification as a high‑risk generic phishing threat. The risk level is set to high, and the domain remains active as of the report date.

The public page title is recorded as “-”, and no specific brand or target is identified in the available intelligence. Consequently, the exact phishing lure or credential‑harvesting technique employed by the site cannot be confirmed at this time. The classification relies solely on the generic_phishing label provided in the threat taxonomy.

Defenders should add the domain fly16aa.com and its resolved IP 104.21.22.39 to deny‑list rules at network perimeter and endpoint filters. Monitoring of DNS queries for the domain and its Cloudflare nameservers is advised, along with periodic re‑scanning on VirusTotal to capture any changes in vendor detections. Because the site leverages Cloudflare’s CDN, direct IP blocking may be less effective; blocking the fully qualified domain name is recommended.

Continued observation is required to determine whether the site begins serving malicious content or expands its phishing campaign. Organizations should educate users about the presence of this domain and enforce multi‑factor authentication to mitigate credential compromise risk.