m[.]madridguncelmobil[.]vip

Analysis indicates that the domain m.madridguncelmobil.vip is actively engaged in phishing operations as of July 12, 2026. The domain was registered on May 30, 2026, through Dynadot Inc, a registrar commonly associated with newly created phishing infrastructure. Infrastructure analysis reveals the domain resolves to IP address 172.67.160.151, which is part of a content delivery network known for providing anonymity and resilience to takedown efforts. The site employs Cloudflare services and HTTP/3, further obscuring its origin and complicating mitigation efforts. The domain appears on two security blocklists, specifically PhishDestroy and BLP-Malware, and has been assigned a trust score of 0/100 by Gridinsoft, indicating high risk. Seven of ninety-five security vendors on a widely used malware analysis platform have flagged the domain, though the specific nature of the phishing content remains unconfirmed due to the generic page title 'Just a moment...' currently displayed. The SSL certificate is issued by Google Trust Services, a legitimate provider, which does not mitigate the malicious intent of the domain. Defenders are advised to treat this domain as hostile and implement blocking measures at the network and endpoint levels. Given its recent registration and use of evasion techniques, monitoring for related domains registered through the same registrar or resolving to the same IP range may be warranted. The domain remains active, and further analysis of its content is recommended to determine the exact phishing vector employed.