send-it[.]fun

Analysis of the domain send-it.fun shows that it was registered on 21 February 2026 through PublicDomainRegistry.com (operated by PDR Ltd.). The site is currently taken offline, and its authoritative name servers are beau.ns.cloudflare.com and kehlani.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The domain resolves to IP address 104.21.73.239, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is present, meaning the site does not serve HTTPS traffic.

The page title returned by the HTTP response is “Google”, and the threat profile lists Google as the targeted brand, confirming a brand‑impersonation intent. The domain has been added to a single security blocklist and is reported as blocked by PhishDestroy. VirusTotal analysis shows that three out of ninety‑three scanning engines flagged the domain, indicating that at least a subset of security products consider it malicious. No additional public threat intelligence such as Safe Browsing, OTX, or kit attribution is provided, so the exact phishing payload or credential‑harvesting mechanism remains unknown.

Defenders should continue to deny any traffic to this host, update perimeter filters to block the IP 104.21.73.239 and the associated Cloudflare CIDR ranges, and incorporate the domain name into URL filtering and email security policies. Monitoring for re‑registration or renewed activity is advisable, given the recent creation date and the use of a reputable DNS provider that can be repurposed for future campaigns. Organizations should also verify that no legitimate services rely on the same IP address before applying blanket blocks, and consider sharing the indicator with threat‑sharing communities to improve collective detection.