yakabet-orjinal-giris[.]vip

Analysis of yakabet-orjinal-giris.vip, observed on July 24, 2026, indicates an active phishing infrastructure targeting users of the Betasus platform. The site presents the page title “Betasus Giriş - Betasus Güncel Erişim - Betasus Resmi Link”, which aligns with the reported scam type of crypto gambling. Registration data shows the domain was created on February 21, 2026 through NiceNIC International Group Co., Limited, and it resolves to 172.67.221.238, an address owned by Cloudflare (AS13335, United States). The nameservers teresa.ns.cloudflare.com and corey.ns.cloudflare.com confirm Cloudflare as the front‑end service, and HTTP/3 support is detected.

An HTTP 525 response was returned, indicating an SSL handshake failure between Cloudflare and the origin server; the presented certificate is issued by Google Trust Services under the WE1 designation. VirusTotal scans report two detections out of 93 security vendors, and the domain is listed on a single security blocklist and blocked by PhishDestroy. Despite the limited number of vendor flags, the combination of a targeted page title, crypto‑gambling lure, and active blocklist presence raises the risk to high. Current uncertainties include the exact payload delivered to victims and whether the origin server hosts credential‑harvesting forms, as the site content has not been examined directly.

Defensive operators should immediately block the domain at DNS and web‑proxy layers, monitor for resolution to the Cloudflare IP range, and consider sinkholing requests to disrupt traffic. Continuous re‑scanning with VirusTotal and other sandbox services is advised to detect any evolving malicious payloads. The infrastructure’s reliance on Cloudflare suggests that takedown of the front‑end service is unlikely without cooperation from the CDN provider, so threat‑intel sharing with regional ISPs and inclusion in broader phishing blocklists remain critical mitigation steps.