free-sign-up-bonus-bgm[.]jilibonus[.]click

The domain free-sign-up-bonus-bgm.jilibonus.click was registered through Dynadot LLC on 2025-03-16 and is currently listed as offline. DNS resolution points to 172.67.204.113, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative name servers are arch.ns.cloudflare.com and paris.ns.cloudflare.com, indicating that the infrastructure is fully hosted on Cloudflare’s edge network. TLS is provided by a certificate issued to Google Trust Services / WE1, which is typical for legitimate Google services but does not confirm the authenticity of the site content. Security telemetry shows the domain appears on one external blocklist and is explicitly blocked by PhishDestroy.

VirusTotal has recorded 12 detections out of 95 scanned scanners, and Gridinsoft’s trust score rates the site at 0 / 100, reflecting a high likelihood of malicious intent. The page title returned by HTTP requests is “Apps on Google Play,” and the threat profile is classified as a tech‑support scam targeting the Google brand. No additional content analysis is available, so the exact phishing vector (e.g., credential‑harvesting form or malicious download) remains unknown. The single blocklist entry suggests limited exposure, but the combination of multiple vendor detections and a zero trust score signals elevated risk.

Defenders should add the domain and its resolving IP address to URL and IP reputation filters, enforce blocklisting of the identified Cloudflare IP range when feasible, and monitor for any re‑registration attempts. Because the SSL certificate is issued by Google Trust Services, reliance on certificate‑based validation alone is insufficient; endpoint inspection or behavioral detection is recommended. Organizations that enforce strict brand‑based allowlists for Google services should treat any traffic to this host as anomalous. Continuous re‑scanning of the domain after potential re‑activation is advised.