tr[.]galabet-adresim[.]icu

This domain, tr.galabet-adresim.icu, is identified as a credential phishing site designed to harvest user login credentials under the guise of a legitimate Galabet service. Analysis of the page title, 'Galabet Hızlı Giriş - Galabet Anlık Site Girişi - Galabet Güncel Erişim Adresi,' indicates an attempt to deceive users into believing they are accessing an official rapid-entry portal for the Galabet platform. No specific drainer kit signatures were detected, but the domain exhibits classic phishing infrastructure characteristics, including the use of Cloudflare for obfuscation and anonymization. Technical indicators confirm the malicious nature of this domain. VirusTotal reports 15 out of 95 security vendors flagging tr.galabet-adresim.icu as malicious, with a Gridinsoft trust score of 0/100. The domain resolves to IP address 172.67.150.92, a Cloudflare-hosted endpoint, and was registered on May 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain was created with a future date, a tactic often employed to evade immediate detection and prolong operational lifespan. As of the latest assessment, tr.galabet-adresim.icu has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat, as domains registered through the same registrar and resolving to similar IP ranges have been observed in recurring phishing campaigns. Users who may have interacted with this domain are advised to reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized access. Organizations should update blocklists to include this domain and its resolving IP to prevent future exposure.