p2-bullishdegen[.]com

Analysis of p2-bullishdegen.com shows the domain is currently offline but was previously identified as a generic phishing site. The site presented the page title "Just a moment...", a common placeholder for challenge pages, and no SSL certificate was observed, indicating unencrypted HTTP service at the time of capture. The domain resolves to IP address 172.67.145.126, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Nameserver records point to arushi.ns.cloudflare.com and quinton.ns.cloudflare.com, confirming the use of Cloudflare DNS.

Registration data lists NiceNIC International Group Co., Limited as the registrar, with the domain creation date recorded as 22 November 2025. Trust scoring from Gridinsoft assigns a zero rating out of 100, reflecting a high likelihood of malicious intent. The domain appears on one public blocklist and has been flagged by the PhishDestroy community for phishing activity.

VirusTotal scans returned two positive detections out of ninety‑five scanners, providing independent confirmation of suspicious behavior. While the exact payload or target brand cannot be confirmed from the available data, the combination of low trust score, blocklist inclusion, community reporting, and multiple vendor detections suggests a credible phishing threat. Defensive teams should add p2-bullishdegen.com to URL filtering and DNS blocklists, monitor for any resurgence of the domain, and consider extending monitoring to the associated IP range and Cloudflare nameservers for related activity.