bugunherzamnkndenguzel345306t5[.]click

The domain bugunherzamnkndenguzel345306t5.click was registered through Sav.com, LLC on 18 May 2026. It is authoritative on the Cloudflare nameservers augustus.ns.cloudflare.com and laura.ns.cloudflare.com and resolves to the IPv4 address 31.56.209.11, which maps to a hosting provider located in the Netherlands (PFcloud). The site presents the default web‑server page and returns an HTTP 303 status code, indicating a redirection without revealing malicious content. The TLS certificate is issued by Let’s Encrypt (R12) and is currently valid. VirusTotal reports that 20 of 91 security vendors have flagged the domain, and it appears on one public blocklist. Independent scoring services assign a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 1 / 100, reinforcing the high‑risk classification. The domain is actively listed as a generic phishing threat with a high risk level and remains reachable. Because the observable infrastructure consists of a recently created domain, Cloudflare DNS, a Netherlands‑based IP, and a valid Let’s Encrypt certificate, automated detection may rely on reputation and vendor detections rather than payload analysis. Defenders should continue to block the domain at network perimeter, update URL filtering feeds, and monitor for any future content changes. Additional investigation of the IP’s hosting environment and correlation with other phishing indicators is advisable.