holiganbet9854[.]icu

The domain holiganbet9854.icu is currently flagged as an active credential theft operation targeting users through deceptive login portals. Analysis indicates this infrastructure is designed to harvest authentication credentials, likely for financial fraud or unauthorized account access. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on July 05, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.16.229, which has been linked to multiple phishing campaigns in recent months. Detection metrics show that 3 of 95 security vendors on VirusTotal have flagged this domain as malicious, a relatively low but notable detection rate that may indicate evasion techniques or recent deployment. No prominent brand impersonation has been confirmed, though the domain name suggests potential targeting of online betting platforms or similar services. Current status confirms holiganbet9854.icu remains active, with no evidence of takedown or mitigation efforts. Organizations and end-users are advised to block traffic to this domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window. Security teams are encouraged to monitor for additional domains registered through the same registrar or resolving to the identified IP, as these may represent related threat infrastructure.