mostbet68667[.]icu

Analysis indicates that the domain mostbet68667.icu is currently active and serves a phishing campaign. The site resolves to the IPv4 address 38.244.195.34, which is registered to 3NT SOLUTIONS LLP in Spain. The domain uses the authoritative nameservers ns1.mostbet68667.icu and ns2.mostbet68667.icu, both hosted on the same infrastructure. TLS is provided by a Let’s Encrypt certificate (YR1), confirming the presence of HTTPS. The HTTP response code is 200, indicating that the web server is delivering content. The page title retrieved from the site reads “Mostbet …” in Cyrillic, suggesting an attempt to impersonate the Mostbet gambling platform. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans show six of ninety‑one security vendors flagging the domain, reinforcing the suspicion of malicious activity. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. While the exact phishing page layout has not been examined, the available indicators confirm that the domain is being used for a high‑risk phishing operation targeting users of the Mostbet service. Defenders should block the domain at perimeter firewalls, update URL filtering policies, and monitor DNS queries for the associated IP and nameservers. Continuous observation of the IP reputation and any new detections is recommended.