berrybenkaofficialjob[.]com

Analysis of the domain berrybenkaofficialjob.com indicates a credential phishing campaign targeting users under the pretext of employment opportunities. The domain was registered on August 31, 2025, through Domainipr Limited, a registrar frequently associated with low-reputation domains. Infrastructure analysis reveals resolution to the IP address 104.21.43.156, hosted on Cloudflare's network (AS13335), a common obfuscation tactic leveraging Cloudflare's proxy services to conceal the origin server. Nameservers hans.ns.cloudflare.com and june.ns.cloudflare.com further confirm Cloudflare's role in the domain's infrastructure. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust signal beyond basic encryption. Detection metrics present a consistent pattern of malicious classification.

AlienVault OTX lists the domain in 17 threat intelligence pulses, indicating active tracking by security researchers. Gridinsoft and Scamadviser both assign a trust score of 0/100 and 1/100, respectively, reflecting negligible legitimacy. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Sixteen of 95 security vendors on VirusTotal flag the domain as malicious, though the absence of additional context limits interpretation of this detection rate. No page title or specific phishing kit was identified in the available data, leaving the exact content and targeted brand uncertain beyond the employment-themed domain name.

Defenders should treat this domain as high-risk for credential harvesting. The combination of Cloudflare hosting, low trust scores, and multiple threat intelligence references justifies immediate blocking at the DNS and proxy levels. Monitoring for related domains registered through Domainipr Limited may reveal additional campaign infrastructure. Given the domain's current offline status, no live indicators are available for further analysis, but historical resolution data (104.21.43.