10032marsbahis[.]com

This domain, 10032marsbahis.com, was registered on 27 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare edge address 188.114.96.3 (AS13335, United States). The authoritative nameservers are autumn.ns.cloudflare.com and guss.ns.cloudflare.com, indicating that the site was hosted behind Cloudflare’s CDN and any origin server details are obscured. No TLS certificate was presented when the site was queried, and the only visible HTTP response contained the page title “Just a moment…”, which provides no insight into the intended victim interaction.

VirusTotal recorded detections from 2 of 93 scanning engines, confirming that a subset of security products identified malicious behavior. The domain has been listed on a single security blocklist and was actively blocked by the PhishDestroy sinkhole, leading to its current offline status. Because the site is no longer reachable, content analysis is limited to the observed page title and the network footprint.

Defenders should continue to deny any outbound connections to 188.114.96.3, add 10032marsbahis.com to local deny lists, and monitor for newly‑registered domains that resolve to the same Cloudflare IP range and use similar naming patterns. Additional scrutiny is warranted for any future domains registered by NiceNIC International Group Co., Limited that exhibit comparable DNS configurations, as the infrastructure may be reused for further phishing campaigns. Until further evidence emerges, the lack of TLS, minimal detection count, and presence on a phishing‑specific blocklist collectively substantiate an elevated risk rating.