garakuta-ichi[.]net

This domain, garakuta-ichi.net, is flagged as a generic phishing site designed to harvest credentials from users interested in horse racing betting. The page title, 凱旋門賞候補馬一覧 (translated as 'Arc de Triomphe Prize Candidate Horse List'), suggests a lure targeting fans of high-profile horse racing events, likely mimicking legitimate betting platforms or racing news portals. No specific brand impersonation or drainer kit signatures were identified in the available data, but the use of localized content indicates a targeted approach toward Japanese-speaking users or those engaged in regional betting markets. Analysis indicates the domain was registered on February 03, 2025, through GMO Internet, Inc., a registrar commonly used for both legitimate and malicious infrastructure. The domain resolves to the IP address 133.242.187.238 and is currently detected by 13 out of 95 security vendors on VirusTotal, with one active blocklist entry. Technologies detected on the server include PHP, AlmaLinux, OpenSSL, and Apache HTTP Server, a common stack that may facilitate dynamic content delivery and obfuscation techniques. The Gridinsoft trust score of 0/100 further corroborates the domain's malicious classification, though no Google Safe Browsing (GSB) status was provided in the available data. As of the latest assessment, garakuta-ichi.net has been taken offline, likely due to hosting provider intervention or registrar enforcement actions. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate phishing content to newly registered lookalike domains. Users who interacted with the site prior to its takedown should assume credential exposure and initiate password resets on any associated accounts, particularly those tied to financial services or betting platforms. Organizations are advised to monitor for related indicators, including the IP address 133.242.187.238 and the domain's registration pattern, to preemptively block emerging threats in this campaign.