trulek[.]com

Analysis indicates that trulek.com is an active phishing domain registered on February 21, 2026, through Gname.com Pte. Ltd. The domain resolves to the IP address 154.82.67.119, hosted on AS399077 (Tcloudnet) in Singapore. Infrastructure review shows nameservers expire1.gname-dns.com and expire2.gname-dns.com, consistent with the registrar's DNS service. The site presents an HTTP 302 redirect, suggesting dynamic routing to a secondary malicious endpoint, though the final destination remains unconfirmed. A Let's Encrypt SSL certificate (YE1) is installed, providing HTTPS encryption likely intended to increase perceived legitimacy. Detection data as of July 12, 2026, shows the domain is flagged by one security vendor on VirusTotal and appears on one blocklist. The domain currently holds a trust score of 0/100 from Gridinsoft and is actively blocked by PhishDestroy. The page title, 'trulek.com', offers no clear indication of the targeted brand or service, and no specific phishing kit or campaign identifier has been linked to this infrastructure. The short registration lifespan—less than five months—aligns with patterns observed in disposable phishing domains. Defenders should treat this domain as high-risk. Network-level blocking of 154.82.67.119 and monitoring of associated DNS infrastructure (expire1.gname-dns.com, expire2.gname-dns.com) is recommended. Further analysis of redirect chains and payload delivery is advised to determine the full scope of the campaign.