bets10adresguncelgiris[.]com

This domain, bets10adresguncelgiris.com, is actively engaged in credential harvesting phishing operations targeting users of a recognized online betting platform. Analysis indicates the site mimics legitimate login portals to capture sensitive account credentials, potentially enabling unauthorized account access and financial fraud. No direct association with known drainer kits has been confirmed at this time, though the infrastructure aligns with common phishing-as-a-service frameworks. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently observed in phishing campaigns. It resolves to the IP address 104.21.26.43, geolocated to a content delivery network provider in Canada, which is consistent with efforts to obfuscate origin and enhance availability. The domain is currently flagged by 1 of 95 security vendors on a major malware aggregation platform, and appears on a single security blocklist. A Let's Encrypt SSL certificate (serial number prefix E8) is deployed, providing HTTPS encryption to lend an appearance of legitimacy. No detections have been recorded in Google Safe Browsing databases as of this analysis. The domain remains active and continues to resolve, posing a persistent threat to users. Response actions include its inclusion on at least one security blocklist, though broader detection remains limited. The use of a content delivery network and a short-lived domain registration pattern suggests an intent to evade long-term detection. Organizations and users are advised to block the domain at the DNS or network level, monitor for credential reuse across platforms, and implement multi-factor authentication to mitigate account compromise risks. Ongoing monitoring of related infrastructure is recommended due to the high likelihood of additional domains leveraging similar naming conventions and registration patterns.