bullishedegen[.]com

Analysis of the domain bullishegen.com indicates it was established as a phishing infrastructure on December 29, 2025, registered through NiceNIC International Group Co., Limited. The domain is currently offline, though it previously resolved to the IP address 104.21.43.203, hosted under AS13335 (Cloudflare, Inc.) in the United States. Cloudflare nameservers (nero.ns.cloudflare.com and nina.ns.cloudflare.com) were in use, a common pattern observed in phishing campaigns leveraging Cloudflare’s proxy services to obscure origin infrastructure. The domain holds a Gridinsoft trust score of 0/100, reflecting high-risk classification, and appears on one security blocklist.

PhishDestroy has flagged this domain, though specific detection criteria are not publicly detailed. VirusTotal reports that three out of ninety-three security vendors have flagged bullishedegen.com, though the precise nature of the threat—whether credential harvesting, malware distribution, or another phishing variant—remains unconfirmed due to the absence of page content analysis. The observed page title, 'Just a moment...', is consistent with Cloudflare’s default interstitial page, suggesting either incomplete deployment of malicious content or deliberate evasion of automated scanners. No SSL certificate was detected, which may indicate either a misconfiguration or an attempt to avoid certificate transparency logs.

Defenders should treat this domain as confirmed malicious infrastructure, particularly given its registration through a registrar frequently associated with abuse and its use of Cloudflare’s proxy network. While the domain is currently offline, historical resolution to 104.21.43.203 and Cloudflare nameservers warrant inclusion in blocklists and monitoring for reactivation. No brand or specific scam type has been identified in the available data, limiting attribution to generic phishing activity.