matbet9730[.]icu

Analysis of matbet9730.icu as of July 20, 2026 indicates a high‑risk generic phishing campaign that remains active. The domain was registered on July 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare’s network, using the authoritative nameservers chris.ns.cloudflare.com and gail.ns.cloudflare.com. DNS resolution points to IP address 104.21.46.138, a Cloudflare edge node that masks the underlying origin infrastructure. The domain appears on one security blocklist and is currently blocked by PhishDestroy, confirming that at least one external sinkhole has taken action. VirusTotal scans show that four of ninety‑five security vendors flag the domain, providing modest but notable detection support. No additional public threat intelligence sources such as OTX or Safe Browsing entries are cited in the available data. The evidence base is limited to registration details, hosting configuration, blocklist presence, and the modest VirusTotal detection count; content‑level analysis, SSL certificate specifics, HTTP response codes, or page‑title metadata have not been disclosed. Consequently, defenders should assume the domain is being used to harvest credentials or redirect victims to malicious payloads. Recommended mitigations include adding the domain to local deny lists, enforcing DNS‑level blocking, and monitoring outbound connections to the associated Cloudflare IP for anomalous traffic. Continuous re‑evaluation is advised, as the short registration age and active blocklist status suggest the campaign could evolve or expand its infrastructure.