mahmutsports106[.]info

Analysis of mahmutsports106.info indicates a high-risk phishing domain targeting users seeking live sports streaming services. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, remains active as of July 12, 2026. The page title, 'Mahmut Sports - Canlı Maç İzle - HD Kalitede Kesintisiz Yayın,' suggests a focus on Turkish-language audiences, offering purported live sports broadcasts in high definition. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3 and employs Cloudflare for hosting, alongside technologies such as Tailwind CSS, jsDelivr, Google Analytics, and HTTP/3, which may be used to enhance legitimacy or evade detection. The domain appears in 24 threat intelligence pulses on AlienVault OTX and is flagged by 4 of 95 security vendors on VirusTotal, though the specific detection context remains unverified. It is currently blocked by two security blocklists, PhishDestroy and BLP-Malware, and has a trust score of 0/100 from Gridinsoft. The SSL certificate is issued by Google Trust Services, a common tactic to appear secure while conducting malicious activity. No confirmed brand impersonation or phishing kit has been identified in available data, though the domain aligns with patterns observed in unauthorized streaming scams. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where sports streaming services are accessed. Monitoring for credential harvesting or malware distribution via embedded scripts is recommended, given the use of third-party content delivery (jsDelivr) and analytics tools. Further investigation into associated infrastructure, such as the hosting IP and certificate chain, may reveal additional linked domains or campaigns. The domain's continued activity suggests ongoing malicious intent, warranting immediate mitigation measures.