theturtlefranklin[.]com

The domain theturtlefranklin.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare address 104.21.48.50 (AS13335, United States). The authoritative name servers are kenia.ns.cloudflare.com and toby.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s CDN and the associated Browser Insights and HTTP/3 services. The SSL certificate is issued by Google Trust Services under the WE1 trust model, providing a valid HTTPS handshake despite the underlying malicious intent. The HTTP response for the root URL returns a 403 status code and the only observable page title is “Just a moment…”. No further page content has been captured, so the specific phishing payload or credential‑capture mechanism remains unknown.

VirusTotal analysis shows that 2 of 93 scanned security vendors flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as malicious, reinforcing the high‑risk classification. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. Given the recent registration date, the use of reputable CDN infrastructure to mask the origin, a valid SSL certificate, and the presence of external blocklist listings, the domain is assessed as a high‑risk phishing resource. Defenders should block DNS resolution for theturtlefranklin.com, add the associated IP 104.21.48.50 to network deny lists, and monitor for any outbound connections to Cloudflare‑served endpoints that may be leveraged for credential harvesting.

Email gateways should be configured to flag or quarantine messages containing links to this domain, and security teams should incorporate the domain into URL reputation feeds. Because the site content has not been fully harvested, the exact target audience, credential fields, or any secondary payloads cannot be confirmed at this time.