eliteworldgrandsapanca[.]com

Analysis of eliteworldgrandsapanca.com shows a newly registered domain (21 Feb 2026) hosted behind Cloudflare’s network (IP 172.67.191.122, AS13335). The site serves HTTP 200 responses over TLS with a Google Trust Services certificate and uses PHP, Tailwind CSS, Vue.js, and third‑party CDNs (unpkg, jsDelivr). The page title advertises “Elite World Grand Sapanca – Lüks Konaklama Deneyimi”, suggesting a hospitality‑related theme, but no further content has been examined. The domain is listed on the PhishDestroy blocklist and 7 of 95 VirusTotal scanners have flagged it, indicating malicious behavior consistent with generic phishing. Registration details point to NiceNIC International Group Co., Limited and the domain uses Cloudflare’s “ashley” and “vern” name servers. The infrastructure is typical of fast‑flux‑style phishing sites that leverage reputable CDNs to obscure origin. While the exact payload and credential‑harvesting mechanisms are not publicly disclosed, the combined blocklist presence, VT detections, and high‑risk rating justify treating the domain as active phishing. Defenders should block the domain at network perimeter, add it to URL filtering policies, and monitor for related DNS queries to the associated Cloudflare IP range. Further investigation of the live page content is recommended to confirm the specific luring technique.