tr[.]galabet-guvenilirgirisim[.]icu

This domain is flagged as a credential-harvesting phishing threat targeting users of gambling platforms under the guise of legitimate login portals. The specific threat type involves impersonating gambling site entry points to capture user credentials, payment details, or personal information. Analysis indicates an elevated risk level due to its targeted nature and the potential for financial fraud or identity theft. Infrastructure analysis reveals the domain tr.galabet-guvenilirgirisim.icu was registered through Dynadot LLC on May 28, 2026, and resolves to the IP address 104.21.20.214. It is currently listed on one security blocklist and blocked by PhishDestroy. The domain employs a Let's Encrypt SSL certificate and utilizes Cloudflare services, including Cloudflare Browser Insights and HTTP/3. VirusTotal reports indicate detection by 16 out of 95 security vendors, with the page title mimicking legitimate gambling login pages: 'Galabet Giriş | Galabet Güncel Adres | Galabet 2026.' The domain has since been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Mitigation steps for this specific threat type include immediate credential rotation for any accounts accessed through the domain, particularly for gambling or financial services. Network administrators should block the domain and its resolving IP (104.21.20.214) at the firewall or DNS level to prevent accidental access. Users should verify the authenticity of gambling login pages by cross-referencing official domains and enabling multi-factor authentication where available. Organizations should monitor for unusual login attempts or credential reuse patterns associated with this domain. Additionally, security teams should review logs for any prior connections to tr.galabet-guvenilirgirisim.icu or its IP to assess potential compromise.