marsbahis-resmi-platformu[.]com

This domain, marsbahis-resmi-platformu.com, is flagged as a credential phishing site targeting users of the Marsbahis online betting platform. The site mimics legitimate login portals, presenting page titles such as 'Marsbahis – Marsbahis Giris – Marsbahis Mobil Giris' to deceive users into submitting account credentials. No specific drainer kit signatures have been confirmed at this stage, though the infrastructure aligns with common phishing deployment patterns observed in similar campaigns. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.77.203, which is part of a content delivery network known for masking origin servers. The domain currently holds a VirusTotal detection score of 0/95, suggesting evasion of automated detection systems despite appearing on one security blocklist. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. The domain has been taken offline, likely due to enforcement actions or infrastructure changes by the hosting provider. However, the remaining risk persists due to the domain's recent creation date and the potential for re-deployment under a new IP or subdomain. Users who accessed the site prior to takedown should assume credential compromise and initiate password resets on all associated accounts. Organizations are advised to monitor for related indicators, including the IP 104.21.77.203 and the registrar NiceNIC, as part of broader threat hunting efforts.