holiganbet7695[.]icu

Analysis of holiganbet7695.icu shows an active generic phishing infrastructure. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the Cloudflare edge address 188.114.96.3, which maps to a Canadian location owned by CloudFlare, Inc. DNS resolution uses the Cloudflare authoritative nameservers chris.ns.cloudflare.com and gail.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint despite the underlying malicious intent. An HTTP request returns a 403 status code and the page title is recorded as "Just a moment...", suggesting the site may be employing a Cloudflare challenge page rather than serving a visible phishing landing page at the time of observation. The domain is flagged by PhishDestroy and appears on a single security blocklist. VirusTotal scans have identified the domain as malicious in five of ninety‑one antivirus engines, reinforcing the suspicion of phishing activity. While the exact credential‑stealing page content has not been captured, the combination of a legitimate‑looking certificate, Cloudflare protection, and detection by multiple security vendors indicates a high‑risk threat. Defenders should block holiganbet7695.icu at network perimeter and DNS layers, monitor for any outbound connections to the IP 188.114.96.3, and update endpoint protection signatures to include the observed VirusTotal detections. Continuous re‑assessment is advised, as the site may evolve its content or hosting configuration.