m[.]livebahisaccount[.]vip

This domain, m.livebahisaccount.vip, is flagged as an active credential phishing site targeting users of online betting platforms. Analysis indicates the domain masquerades as a legitimate account login portal, likely designed to harvest usernames, passwords, and potentially financial details from unsuspecting victims. No specific drainer kit signatures have been identified, but the infrastructure aligns with common phishing-as-a-service deployments using Cloudflare proxy services. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on December 13, 2025, an unusually future-dated creation timestamp that may indicate domain age obfuscation. It resolves to IP address 172.67.152.94, hosted on Cloudflare, Inc. (AS13335) infrastructure in the United States. The domain currently lacks an SSL certificate, exposing credentials to potential interception during transmission. VirusTotal detection shows 2/95 security vendors flagging the domain, while it appears on one security blocklist and is actively blocked by at least one anti-phishing service. The page title 'Attention Required! | Cloudflare' suggests either a misconfigured phishing page or an attempt to mimic Cloudflare security challenges to appear legitimate. As of the latest verification, m.livebahisaccount.vip remains active and accessible. Immediate response actions should include adding the domain to enterprise blocklists, monitoring for credential reuse attempts, and alerting users to the specific threat. The remaining risk is high due to the domain's active status, lack of SSL encryption, and low detection rate among security vendors. Organizations should treat any credentials entered on this domain as compromised and initiate password reset procedures for affected accounts. Network-level blocking of the IP address 172.67.152.94 is recommended as a temporary mitigation measure.