join-flyngtulip[.]com

The domain join-flyngtulip.com was registered on February 27, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers kara.ns.cloudflare.com and stan.ns.cloudflare.com. No TLS certificate is presented, leaving the site without HTTPS protection. The HTTP response returned a page titled "Just a moment...", which provides no additional context about the content or intended victim interaction.

The domain currently appears on a single security blocklist and is explicitly listed by PhishDestroy as a malicious resource. VirusTotal analysis recorded five positive detections out of ninety‑three scanned security vendors, indicating that multiple independent scanners have identified malicious behavior. Additionally, Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment of high risk. The domain’s status is reported as offline, which may be a temporary takedown or a deliberate shutdown after detection.

While the exact phishing payload or targeted brand is not disclosed in the available data, the combination of blocklist inclusion, multiple vendor detections, and the absence of SSL suggests a credential‑harvesting operation. Defenders should immediately block join-flyngtulip.com at perimeter filters, update internal threat intelligence feeds, and monitor for any related C2 infrastructure that may share the same Cloudflare IP range. Continuous re‑evaluation is advised in case the domain re‑appears or new indicators emerge.