c0inbar-web[.]icu

This domain is flagged as a high-risk credential theft operation targeting users of the Zirvebet platform. Analysis indicates the site impersonates the legitimate Zirvebet login portal, using the page title 'Zirvebet Platformu Girişi - Zirvebet 2026 Adresi - Zirvebet Güncel' to deceive victims into entering sensitive account credentials. The threat type is specifically credential theft, not generic phishing, as the infrastructure and content are designed to harvest login details for financial fraud or account takeover purposes.

Technical indicators confirm the domain's malicious nature. c0inbar-web.icu resolves to IP address 188.114.97.3 and was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal detection rates show 3 out of 95 security vendors have flagged the domain as malicious. The domain appears in two AlienVault OTX threat intelligence pulses, further corroborating its association with malicious activity. Infrastructure analysis reveals no legitimate association with Zirvebet, and the recent registration date aligns with common phishing campaign timelines.

Mitigation steps for this credential theft threat include immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Organizations should deploy browser-based warnings for users attempting to access the domain and implement multi-factor authentication (MFA) for all accounts that may have been exposed. Users who may have interacted with the site should reset credentials for Zirvebet and any other platforms where the same credentials were reused. Security teams should monitor for signs of account compromise, such as unusual login attempts or unauthorized transactions, and conduct a review of recent authentication logs for indicators of exposure.