notinretardeducation[.]run

Analysis of the domain notinretardeducation.run shows a recent creation date of February 27, 2026 and immediate association with malicious activity. The domain resolves to IP address 172.67.141.23, which belongs to AS13335 Cloudflare, Inc., located in the United States. No SSL certificate was observed, and the HTTP response presents the generic page title "Just a moment...", a pattern commonly used by Cloudflare challenge pages that can be abused to hide malicious content. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, confirming the Cloudflare hosting relationship.

Blocklist intelligence indicates that three independent security blocklists have listed the domain, with specific blocklists including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded a single positive detection out of 93 scanned vendors, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of confidence in the domain’s legitimacy.

The domain is currently taken offline, which limits immediate exposure but does not remove the underlying infrastructure or the risk of re‑activation. Defenders should continue to enforce blocklist rules that include notinretardeducation.run, monitor the associated IP 172.67.141.23 for any future activity, and consider adding the domain to internal blacklists. Given the absence of TLS, low trust scoring, and presence on multiple phishing‑focused blocklists, the domain should be treated as a high‑confidence phishing indicator until further evidence suggests remediation.