gloopclub[.]com

Analysis of the domain gloopclub.com indicates active phishing infrastructure designed to harvest credentials. Registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to 172.67.140.6, an address associated with Cloudflare, Inc. in Canada. The site presents an HTTP 403 status, though the page title 'Just a moment...' suggests a Cloudflare interstitial or a deliberate evasion tactic to obscure malicious content from automated scanners. The domain is hosted behind Cloudflare nameservers courtney.ns.cloudflare.com and jaziel.ns.cloudflare.com, a common technique to conceal origin servers and complicate takedown efforts. SSL certification is provided by Let's Encrypt (serial E7), which while legitimate, offers no assurance of benign intent. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. AlienVault OTX records the domain in a single threat intelligence pulse, indicating limited but confirmed malicious activity. VirusTotal reports one detection out of 95 security vendors, a low but non-zero signal that warrants caution. The domain's creation three months prior aligns with typical phishing campaign lifecycles, where domains are registered shortly before deployment. Defenders should treat any interaction with gloopclub.com as high-risk, particularly if the page transitions from the observed interstitial to a login or data submission prompt. Network-level blocking of 172.67.140.6 and monitoring for related Cloudflare-resolved domains with similar registration patterns is recommended.