tr[.]orjinal-padisahbet[.]icu

Analysis of the domain tr.orjinal-padisahbet.icu indicates active credential-phishing infrastructure targeting users as of July 24, 2026. The domain was registered on July 23, 2026, through DYNADOT LLC, a registrar frequently observed in recent phishing campaigns. Infrastructure analysis reveals the site is hosted on Cloudflare nameservers deb.ns.cloudflare.com and nash.ns.cloudflare.com, resolving to the IP address 172.67.185.155. This IP has been associated with multiple short-lived domains in prior investigations, though no autonomous system or geolocation details are currently confirmed.

Detection data shows limited but targeted flagging: two of ninety-one security vendors on VirusTotal have classified this domain as malicious, while the PhishDestroy blocklist has already included it. The domain remains active, with no indication of takedown or suspension at the registrar or hosting level. No Safe Browsing or Open Threat Exchange records are available at the time of this report, and the exact content or targeted brand has not yet been analysed. The domain name itself suggests a possible association with online gambling or betting platforms, though no brand confirmation is present in available data.

Defenders should treat this domain as high-risk due to its recent registration, Cloudflare-hosted infrastructure, and early detection by security vendors. Network-level blocking is recommended, particularly for organisations in sectors where credential harvesting poses elevated risk. Further investigation into the hosting IP and registrar activity may reveal additional linked domains. Monitoring for changes in detection status or infrastructure is advised, as this domain exhibits characteristics typical of rapidly deployed phishing campaigns.