royalbet-girism[.]icu

This domain, royalbet-girism.icu, is currently under investigation for credential theft phishing operations. Analysis indicates the infrastructure is designed to harvest login credentials, likely through fraudulent login portals mimicking legitimate services. The domain has not yet been widely flagged but exhibits characteristics consistent with targeted phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 21, 2026, through FewMoreTaps OÜ, an entity frequently associated with high-risk registrations. It resolves to IP address 172.67.164.21 and employs Cloudflare services, including HTTP/3, to obfuscate its origin. The SSL certificate is issued by Let's Encrypt, a common choice for malicious domains due to its low-cost and automated issuance. Despite 0 detections out of 95 engines on VirusTotal, the domain appears on 2 security blocklists (PhishDestroy and OISD) and was referenced in 1 AlienVault OTX threat intelligence pulse. The page title, 'royalbet-girism.icu | 522: Connection timed out,' suggests either temporary downtime or deliberate evasion tactics. Mitigation steps for credential theft phishing involve immediate containment and user awareness. Network administrators should block the domain and its resolving IP (172.67.164.21) at the perimeter firewall and DNS levels. Endpoint protection systems should be updated to include this domain in deny lists, and users should be educated on recognizing phishing attempts, particularly those impersonating login pages. Given the domain's recent registration and low detection rate, monitoring for related domains registered through FewMoreTaps OÜ is recommended to preempt further campaigns. Incident responders should analyze logs for connections to 172.67.164.21 or interactions with the domain to identify compromised credentials.