register-store[.]fun

Analysis of register-store.fun performed on July 23, 2026 reveals a newly registered domain that has been used for a generic phishing campaign and is currently taken offline. The domain was created on February 21, 2026 and resolves to the IP address 104.21.1.122, which is hosted by Cloudflare, Inc. (AS13335) and geolocated in the United States. The TLS certificate presented by the site is identified as WE1, indicating that encrypted traffic was available during the brief period the site was active. VirusTotal scans show that two of ninety‑three security vendors flagged the domain as malicious, confirming that at least a subset of scanners recognized suspicious behavior.

Independent reputation services assign extremely low confidence scores: Gridinsoft rates the domain 0 out of 100, and Scamadviser rates it 1 out of 100, reflecting a high likelihood of malicious intent. The site appears on one security blocklist and is explicitly blocked by the PhishDestroy service, providing additional confirmation of its abusive nature. The only observable content is the page title "Just a moment...", which offers no insight into the phishing payload or targeted brand. No further technical details such as a phishing kit, credential‑harvesting form, or redirection chain have been disclosed, leaving the exact malicious workflow uncertain.

Defenders should immediately block both the domain name and its associated IP address at perimeter firewalls and DNS filtering layers. Because the hosting provider is Cloudflare, the IP may be shared with legitimate services; therefore, monitoring for any resurgence of the domain or related sub‑domains is advisable. Adding the domain to internal threat intelligence feeds, updating URL reputation databases, and ensuring endpoint protection solutions are aware of the two VirusTotal detections will help mitigate any residual risk.