royale[.]icu

The domain royale.icu was registered on 27 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 104.21.49.105, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The authoritative nameservers amir.ns.cloudflare.com and tegan.ns.cloudflare.com confirm the use of Cloudflare's CDN and DDoS‑mitigation services. No TLS certificate is presented for the host, indicating that HTTPS is not configured or that the certificate data was unavailable at the time of inspection. The HTTP response returned the page title “Just a moment…”, which is commonly associated with Cloudflare’s interstitial challenge page rather than with any visible phishing content.

Gridinsoft assigned a trust score of 0 / 100, reflecting a maximal negative assessment. VirusTotal analysis recorded six detections out of ninety‑three scanners, and the domain appears on a single external blocklist. PhishDestroy has also listed the host as blocked, and the operational status is currently marked as offline. The available evidence points to a generic phishing infrastructure that leverages Cloudflare’s front‑end services to obscure the true origin of the malicious payload. The lack of an SSL certificate, combined with the generic page title, suggests that the site may have been serving a temporary challenge page before redirecting victims to credential‑harvesting pages, a pattern observed in other phishing campaigns.

Because the domain is presently offline, content cannot be verified, leaving the exact lure and credential collection mechanism uncertain. Defenders should continue to enforce blocking of royale.icu at network perimeter and DNS layers, add the address 104.21.49.105 to host‑based deny lists, and monitor for new subdomains registered under the same Cloudflare account or similar NiceNIC registrars. Regular re‑scans against multi‑engine services are recommended to capture any future re‑activation.