sanaldosyam[.]net

On July 23 2026 analysts examined the domain sanaldosyam.net, which was created on 17 October 2025 through the registrar Spaceship, Inc. The domain resolves to the IP address 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented the page title “e-Devlet Kapısı” and was served over TLS using a certificate identified as WE1. Threat intelligence sources classified the site as a generic phishing operation. It appears on one public security blocklist and is explicitly blocked by the PhishDestroy feed. AlienVault OTX has referenced the domain in fourteen separate pulses, indicating recurring observations across multiple threat‑intel collections.

A VirusTotal scan returned eight positive detections out of ninety‑three scanning engines, reinforcing the malicious assessment. The Gridinsoft trust score of zero out of one hundred further underscores the lack of legitimacy. At the time of review the HTTP service was taken offline, and the domain is currently inactive. While the available data confirms malicious intent, no payload samples, credential‑harvesting forms, or detailed page content have been captured, leaving the exact phishing kit and victim targeting unknown.

Defenders should immediately add sanaldosyam.net to DNS‑based blocklists and firewall deny rules, and also block the associated Cloudflare IP 188.114.97.3 to prevent possible re‑hosting. Continuous monitoring of the registrar Spaceship, Inc. for new domains and of the AS13335 address space for similar activity is advised. Integration of the domain and IP into endpoint protection and web‑proxy filters will reduce exposure. Given the low trust score, presence on blocklists, multiple vendor detections, and OTX references, the infrastructure should be treated as high‑confidence phishing infrastructure pending further investigation.