betcio-guncel[.]icu

This domain, betcio-guncel.icu, is assessed as high risk due to its active operation as a brand impersonation phishing site targeting the Kavbet gambling platform. The threat type is specifically brand impersonation, where the domain mimics official Kavbet services to harvest login credentials and personal data from users. The page title, 'Kavbet Giriş - Profesyonel Bahis ve Canlı Casino,' is designed to deceive visitors into believing they are accessing a legitimate betting and casino site, thereby facilitating credential theft.

Infrastructure analysis reveals several concrete technical indicators. The domain was created on June 17, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting high-risk domains. It resolves to IP address 104.21.59.217, which is associated with Cloudflare infrastructure (SSL certificate issued by Google Trust Services). VirusTotal data shows 2 out of 95 security vendors flag this domain as malicious, indicating low detection rates among security products. The domain remains active and is not currently listed on major blocklists, enabling ongoing attacks.

Mitigation steps specific to this brand impersonation threat include: immediately blocking the domain at network and email gateways to prevent user access; adding the IP 104.21.59.217 to firewall deny lists; deploying web filtering rules to block URLs containing 'betcio-guncel.icu' or similar misspellings of Kavbet; and warning users not to enter credentials on any site mimicking Kavbet. Organizations should also monitor for any data exfiltration attempts and reset credentials for any users who may have interacted with this domain.