promo-sun[.]pro

Analysis of promo-sun.pro indicates that the domain was registered through Fewmoretaps OU d/b/a Trustname.com on 22 July 2026. The domain is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers achiel.ns.cloudflare.com and opal.ns.cloudflare.com, and resolves to the IP address 188.114.97.3. The IP belongs to a Cloudflare‑provided edge node, which is commonly used by both legitimate services and malicious actors to mask origin servers. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist, confirming that at least one anti‑phishing organization has observed malicious activity associated with it.

VirusTotal reports that the domain was scanned by 91 antivirus and URL‑reputation engines; none of the engines raised a detection, but the lack of a flag does not constitute evidence of safety. The threat classification supplied is “generic phishing,” and the current operational status is active while the risk level remains under investigation. Defenders should note that the recent creation date leaves little historical reputation, and the reliance on Cloudflare’s shared hosting makes passive DNS and IP‑based reputation less reliable. Because the domain is already listed on a phishing blocklist, web filters and endpoint protection solutions should block or quarantine any traffic to promo-sun.pro.

Network defenders may also consider sink‑holing the IP address 188.114.97.3, though legitimate services may share the same edge node. Continuous monitoring of the domain’s DNS records, any changes to its hosting provider, and the emergence of new detections on threat‑intel platforms is advised. Until a definitive attribution is made, organizations should treat the domain as malicious and prevent user interaction.