frank[.]insol[.]fun

Analysis of the domain frank.insol.fun shows that it was registered on July 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 104.21.78.199. The domain is serviced by Cloudflare DNS, as indicated by the authoritative nameservers cheryl.ns.cloudflare.com and hank.ns.cloudflare.com. As of the report date, July 30, 2026, the domain remains active and has been observed on a single security blocklist, with PhishDestroy explicitly listing it as blocked.

VirusTotal records indicate that the domain has been scanned by 91 antivirus and URL‑reputation vendors, none of which reported a detection at the time of scanning; this absence of detections does not constitute confirmation of benign intent. No additional telemetry such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts is available in the current intelligence set, leaving the exact content and any credential‑harvesting mechanisms unverified. The recent creation date, use of a reputable CDN provider, and rapid appearance on a phishing blocklist suggest a short‑lived infrastructure typical of generic phishing campaigns.

Defenders should prioritize immediate containment by adding frank.insol.fun to URL filtering and DNS‑sinkhole rules, consider blocking the associated IP 104.21.78.199 at the network perimeter, and monitor for any new indicators that may emerge from the hosting provider. Continuous re‑scanning with multi‑vendor services is recommended to capture any future malicious payloads or changes in the domain’s behavior.