bul-limanbet[.]icu

This domain, bul-limanbet.icu, is identified as an active phishing site specifically targeting users of online betting platforms. Analysis indicates the infrastructure is designed to impersonate legitimate betting services, likely to harvest credentials, payment details, or deploy malware. The domain remains operational and poses a high risk to unsuspecting visitors seeking gambling-related services. Infrastructure analysis reveals the domain was registered on June 20, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.165.178, which has been linked to other malicious activities in recent threat intelligence reports. Detection metrics show the domain is flagged by 1 of 95 security vendors on VirusTotal, while AlienVault OTX lists it in one threat intelligence pulse, indicating limited but confirmed malicious activity. The creation date, combined with the registrar's reputation and the IP's history, further corroborates the phishing classification. Current status confirms bul-limanbet.icu remains active, with no evidence of takedown or mitigation efforts. Organizations and individuals are advised to block the domain at the network level and include its IP address in firewall rules. End-users should avoid interacting with the site, particularly those associated with betting or financial transactions. Security teams are recommended to monitor for related indicators of compromise, such as connections to 172.67.165.178 or domains registered through the same registrar, to prevent potential credential theft or malware distribution.