allan-affecting-modern-air[.]trycloudflare[.]com

The domain allan-affecting-modern-air.trycloudflare.com is currently active and classified as a generic phishing threat with an elevated risk rating. Infrastructure analysis shows the domain resolves to the IP address 104.16.230.132, which is hosted behind Cloudflare’s edge network. Registration details indicate the domain is associated with a Cloudflare Tunnel, a service that can obscure the true origin of the host and is frequently leveraged by threat actors to hide malicious infrastructure.

The domain’s nameserver information is unavailable (NS_NOT_FOUND), limiting visibility into its DNS delegation path. Detection telemetry reveals that six out of ninety‑one security vendors on VirusTotal have flagged the domain, suggesting a moderate consensus of malicious behavior among scanning engines. Additionally, the domain appears on a single external security blocklist, and it has been explicitly blocked by the PhishDestroy protection service, confirming that at least one anti‑phishing platform has identified it as abusive.

While these indicators collectively demonstrate a malicious profile, certain operational details remain unknown, including the precise content served, SSL certificate particulars, and HTTP response characteristics, because they have not been publicly disclosed or analyzed. Defenders should prioritize blocking the domain at network perimeters and within endpoint protection suites, update URL filtering policies to include the observed blocklist entry, and monitor for any traffic to the associated Cloudflare IP range. Ongoing surveillance of VirusTotal and other multi‑vendor reputation services is advised to capture any changes in detection counts or additional vendor assessments that could refine the risk posture.