eniyibonusal[.]com

Analysis of eniyibonusal.com shows a freshly registered domain (created June 22, 2026) that was actively used for a phishing campaign before being taken offline. The site was blocked by PhishDestroy and currently appears on a single security blocklist, indicating at least one external sinkhole or blacklist has flagged it. The domain resolves to IP 172.67.188.126, which is part of Cloudflare's AS13335 network located in the United States; the same IP is shared by many unrelated legitimate services, reducing the value of IP reputation alone. The SSL certificate is issued by Google Trust Services under the WE1 profile, a standard certificate for Cloudflare‑proxied sites, and thus does not provide any indication of malicious intent.

The registrar listed is NameSilo, LLC, a common bulk‑registration provider, and the nameservers are annabel.ns.cloudflare.com and fred.ns.cloudflare.com, both standard Cloudflare resolvers. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low confidence rating. VirusTotal reports that three of ninety‑one scanned vendors flagged the domain, confirming that multiple detection engines have identified malicious behavior.

The page title "Bonus Fırsatları" suggests a Turkish‑language incentive lure, but no further content analysis is available because the site is offline. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the same host header or similar page titles, and consider adding the IP address to reputation lists despite its shared nature. Ongoing vigilance is recommended, especially for users receiving unsolicited offers in Turkish that reference bonuses, as these may be associated with the same campaign infrastructure.