enfejartest[.]com

Analysis of enfejartest.com confirms it as an active phishing domain targeting users with a fake gaming reward scheme. The page title, rendered in Persian, advertises a 'free explosion game' and a simulator offering '100 free coins,' suggesting a lure designed to harvest credentials or payment details under the guise of in-game rewards. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP 188.114.97.3, hosted behind CloudFlare (AS13335, Canada). SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites, providing no inherent trust signal. As of July 19, 2026, four out of 91 security vendors on VirusTotal flag the domain, and it appears on one security blocklist, including PhishDestroy. AlienVault OTX lists it in a single threat intelligence pulse, indicating limited but confirmed malicious activity. Nameservers are CloudFlare-hosted (kellen.ns.cloudflare.com, treasure.ns.cloudflare.com), which is consistent with many phishing campaigns leveraging CloudFlare’s proxy services to obscure origin infrastructure. Defenders should treat this domain as high-risk. Block access at the network level and monitor for connections to 188.114.97.3 or the domain itself in proxy, DNS, and endpoint logs. The specific brand or platform being impersonated is not confirmed in available data, but the Persian-language content suggests targeting of Persian-speaking users. No evidence of a known phishing kit or malware payload is present; the threat appears limited to credential or financial harvesting via social engineering. Further analysis of the site’s backend or user interaction flow is required to determine exact data collection methods.