register-armygang[.]fun

Analysis of the domain register-armygang.fun shows a short operational window between its creation on February 21, 2026 and its takedown prior to the report date of July 25, 2026. The domain was registered through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure, using the nameservers emma.ns.cloudflare.com and hasslo.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented, indicating the site served only HTTP content.

The only observable page element is the title "Just a moment..."; the full page content has not been captured. Security telemetry indicates the domain was blocked by PhishDestroy and is listed on a single security blocklist. A VirusTotal scan recorded a single positive detection out of 93 scanning engines, confirming at least one vendor identified malicious behavior. The current status is offline, suggesting the phishing infrastructure has been disrupted or removed.

Uncertainties remain regarding the specific phishing payload, target victims, and whether additional infrastructure (e.g., command‑and‑control servers) was employed, as no further artifacts or Safe Browsing entries are available. Defenders should continue to block the domain at perimeter firewalls and proxy filters, add the IP address 188.114.96.3 to threat‑intel feeds, and monitor DNS queries for similar Cloudflare‑hosted subdomains. Ongoing observation of the registrar NiceNIC and associated nameservers is advised to detect any re‑registration attempts.