belugabahisadresi[.]icu

PhishDestroy has identified belugabahisadresi.icu as an active credential theft domain targeting users with a fraudulent login interface designed to harvest credentials. This domain mimics legitimate betting platforms, specifically those associated with 'Beluga Bahis,' to deceive victims into entering their login details. The threat actor behind this campaign operates a generic phishing page that captures submitted credentials and likely exfiltrates them for subsequent abuse, including account takeover and financial fraud. Given the domain's recent registration and active status, users interacting with this page face an elevated risk of credential compromise and potential follow-on attacks. This domain was flagged by PhishDestroy with concrete indicators confirming its malicious intent. VirusTotal analysis shows that only 2 out of 95 security vendors currently detect belugabahisadresi.icu as malicious, highlighting the stealthy nature of this threat. The domain was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often abused by threat actors for bulletproof hosting. The domain resolves to IP address 172.67.190.109 and utilizes a Let's Encrypt SSL certificate to appear legitimate. Despite its recent creation, the domain has already been reported by multiple threat intelligence sources, underscoring its active deployment in credential theft campaigns. Users who visited or submitted information to belugabahisadresi.icu should immediately reset passwords for all accounts using the same or similar credentials. Enable multi-factor authentication (MFA) wherever possible to mitigate the risk of account takeover. Report the incident to your organization’s security team or relevant platform support if the credentials were linked to corporate or sensitive accounts. Monitor financial and account activity closely for signs of unauthorized access or fraudulent transactions. Avoid clicking on links or downloading files from this domain or any associated URLs to prevent further exposure.