allocation[.]flyinhgtulip[.]mom

The domain allocation.flyinhgtulip.mom was identified as a generic phishing infrastructure with an elevated risk level, currently offline as of July 22, 2026. Analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. The domain uses Cloudflare nameservers (angelina.ns.cloudflare.com and yisroel.ns.cloudflare.com) but lacks an SSL certificate, a common red flag in phishing operations.

The page title associated with the domain is 'Flying Tulip,' though the exact content or targeted brand remains unconfirmed due to the site being offline. Only one of 93 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, indicating high suspicion. No additional details about the phishing kit, lure type, or victim interaction are available at this time.

Defenders should treat this domain as part of a broader phishing campaign, particularly given its use of Cloudflare for hosting and DNS services, a tactic frequently observed in malicious infrastructure. The absence of SSL and the low detection rate do not diminish the risk; phishing domains often evade initial scans before being widely flagged. Network defenders are advised to block the domain and its resolved IP (188.114.97.3) at the perimeter, monitor for related subdomains or typosquatting variants, and review logs for prior connections to this infrastructure. Further analysis of the site's content is not possible due to its offline status, but the available indicators align with known phishing patterns.