throwing-gilbert-true-delivering[.]trycloudflare[.]com

Analysis of the domain throwing-gilbert-true-delivering.trycloudflare.com indicates it was actively impersonating Instagram to distribute a fraudulent followers scheme. The page title, 'Get Free Instagram Followers- 100% [Free, Real, No Survey]- iDigic,' explicitly targets Instagram users with promises of free followers, a common tactic in social media phishing campaigns. The domain was registered on February 21, 2026, and leveraged Cloudflare Tunnel infrastructure, resolving to IP 104.16.230.132 (AS13335, Cloudflare, Inc., US). This IP is associated with Cloudflare's content delivery network, which is frequently abused for phishing due to its ease of setup and ephemeral nature.

Security vendor Gridinsoft assigned a trust score of 0/100, and the domain appears on at least one security blocklist, with PhishDestroy confirming its malicious status. VirusTotal detections from 15 of 93 vendors further corroborate its classification as a phishing threat. The domain's SSL certificate (WE1) is issued by Cloudflare, which does not inherently indicate legitimacy due to the platform's widespread use for both legitimate and malicious purposes. As of July 25, 2026, the domain has been taken offline, though defenders should monitor for re-emergence under similar subdomains or infrastructure.

Infrastructure analysis reveals no evidence of a custom registrar or hosting provider, as the domain was created via Cloudflare's trycloudflare.com service, which allows rapid deployment without traditional registration. The lack of a unique registrar or hosting footprint complicates long-term tracking but aligns with the transient nature of phishing campaigns. Defenders are advised to block the domain and its resolving IP at the network level, and to alert users about the specific scam type (free followers offers) targeting Instagram. No additional page content or phishing kit details are available for further classification.