marsbahis-upgiris[.]icu

This domain is flagged as a credential harvesting phishing site designed to mimic legitimate online betting platforms. Analysis indicates it targets users attempting to access gambling or wagering services, tricking them into submitting login credentials, payment details, or personal information through fraudulent login portals. The domain employs social engineering tactics, including cloned interfaces and urgent messaging, to deceive victims into disclosing sensitive data. Infrastructure analysis reveals the domain was registered on June 15, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with low-reputation domains. As of the latest scan, the domain has 0/95 detections on VirusTotal, suggesting it remains undetected by most security vendors. It resolves to IP address 172.67.191.204, which is hosted on a content delivery network (CDN) known for masking malicious infrastructure. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Gridinsoft’s trust score for this domain is 0/100, further confirming its high-risk nature. Users who have visited marsbahis-upgiris.icu or entered credentials on the site should immediately revoke access to any associated accounts, particularly those linked to financial services or email addresses. Reset passwords using a secure device and enable multi-factor authentication (MFA) where available. Monitor accounts for unauthorized transactions or login attempts and report any suspicious activity to the affected platform’s security team. If payment details were submitted, contact financial institutions to block transactions and issue new cards. Organizations should add the domain and its resolving IP (172.67.191.204) to blocklists and conduct internal investigations for potential exposure.