kuleli-baro[.]vip

Analysis of kuleli-baro.vip shows multiple indicators consistent with a malicious phishing operation. The domain was created on March 06, 2026 and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.97.3, locating the server in the United States. No SSL certificate is presented, meaning HTTPS connections are not established, which is atypical for legitimate sites and increases the risk of credential interception. The authoritative nameservers listed are deborah.ns.cloudflare.com and watson.ns.cloudflare.com, both Cloudflare‑managed, confirming the hosting relationship.

Registration was performed through NiceNIC International Group Co., Limited, a registrar that has been observed in other abuse cases, though no further registration details are disclosed. The page title returned from the site is "Cuhara SEO - Giris," a phrase that does not correspond to a known brand and suggests the site may be attempting to lure users with SEO‑related terminology. PhishDestroy has already blocked the domain, and it appears on a single security blocklist, indicating that at least one external threat‑intel source has flagged it. VirusTotal analysis shows that 1 of 94 scanning engines flagged the domain, providing a minimal but concrete detection signal.

The current operational status is offline, which prevents immediate interaction but does not eliminate residual risk for any previously visited users or cached content. Uncertainty remains regarding the exact phishing payload, target audience, and whether additional malicious infrastructure is linked to the same IP range, as no Safe Browsing, OTX, or broader threat‑feed data were supplied. Defenders should add kuleli-baro.vip to local blocklists, monitor for any future resolution to the same IP or nameserver pair, and consider the domain as a high‑confidence phishing indicator when encountered in network traffic or email links.