getflr[.]xyz

On 24 July 2026, the domain getflr.xyz was observed as offline but retains infrastructure that matches a generic phishing operation. The domain was registered on 5 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is delegated to Cloudflare nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com. DNS resolution points to 104.21.37.186, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating use of a legitimate certificate authority for encrypted connections.

Reputation scoring from Gridinsoft assigns a value of 0 out of 100, reflecting a highly untrusted status. Independent blocklists from PhishDestroy, MetaMask, and SEAL have already listed the domain, and three additional public blocklists reference it. VirusTotal analysis shows that six out of ninety‑one scanning engines raise detections, reinforcing the malicious classification. No public page title or content snapshot is available, so the exact lure or credential‑harvesting page cannot be confirmed at this time.

The combination of recent registration, Cloudflare‑based hosting, low trust score, multiple blocklist entries, and partial VirusTotal detections suggests the domain was created for a short‑lived phishing campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the IP address, and consider adding the associated IP to threat‑intel feeds. Further investigation of any associated URLs or payloads, should the domain become active again, is recommended to refine detection signatures.