pusula-guncel2026[.]vip

Analysis indicates that the domain pusula-guncel2026.vip was registered on 23 February 2026 through NiceNIC International Group Co., Limited and presently resolves to the Cloudflare edge address 188.114.96.3, belonging to AS13335. The site is protected by a Let’s Encrypt certificate (issuer E7) and serves content over HTTP/3, with PHP detected on the backend. HTTP requests return a Cloudflare 523 error, suggesting the origin server is unreachable, consistent with the reported offline status. The page title returned by the server reads “Pusulabet Güncel Giriş 2026 | Hızlı Erişim, Rehber ve SSS”, which directly references the Pusulabet brand and implies a login portal.

Security telemetry shows the domain is listed on one blocklist and has been blocked by the PhishDestroy feed. VirusTotal scans report three detections out of ninety‑three vendors, confirming malicious classification by a minority of scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation. Nameservers teresa.ns.cloudflare.com and corey.ns.cloudflare.com confirm Cloudflare DNS management.

The combination of a brand‑specific title, low trust score, partial vendor detections, and blocklist presence points to a credential‑harvesting operation targeting users of the Pusulabet service. Uncertainty remains regarding the current content of the site because the HTTP 523 response prevents retrieval of the full page. Defenders should continue to block the domain at perimeter and DNS layers, monitor for related C2 infrastructure associated with the same IP range, and update threat intelligence feeds with the observed indicators. Additional investigation, such as capturing live traffic if the site becomes reachable, would be required to confirm the exact phishing layout and any embedded malware.