holiganbet8035[.]icu

The domain holiganbet8035.icu was registered on July 20, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of the report date, July 26, 2026. DNS resolution points to the IP address 188.114.97.3, and the domain is served by Cloudflare’s authoritative name servers chris.ns.cloudflare.com and gail.ns.cloudflare.com. The use of Cloudflare’s DNS infrastructure is consistent with a pattern of threat actors leveraging reputable CDN services to hide the true origin of malicious content and to benefit from built‑in DDoS protection.

The domain has been added to at least one public security blocklist and is actively blocked by the PhishDestroy remediation platform, indicating that external threat‑intelligence feeds have already flagged it as malicious. VirusTotal records show that the domain was submitted for analysis and examined by 91 antivirus vendors, none of which reported a detection at the time of scanning; this lack of detection should not be interpreted as evidence of benign intent, but rather reflects the early stage of the campaign and the possibility that the payload is either novel or not yet captured by existing signatures. No additional public intelligence—such as Safe Browsing verdicts, OTX indicators, SSL certificate details, HTTP response codes, or page title information—has been disclosed, leaving the precise content and intended victim lure unknown.

Given the recent creation date, the association with a known blocklist, and the Cloudflare‑based hosting, defenders should treat holiganbet8035.icu as a high‑confidence indicator of phishing infrastructure. Recommended mitigation steps include adding the domain to outbound allow‑list deny rules, updating DNS filtering policies to block resolution, monitoring network logs for any connections to 188.114.97.3, and correlating internal security events with the blocklist entry.