1722marsbahis[.]com

Analysis of 1722marsbahis.com shows a newly registered domain created on 27 February 2026 and currently taken offline. The domain resolves to IP address 104.21.70.165, which is part of Cloudflare’s network (AS13335) located in the United States. The hosting is provided through Cloudflare’s DNS service, as indicated by the authoritative nameservers audrey.ns.cloudflare.com and bradley.ns.cloudflare.com. No TLS certificate is presented, meaning HTTPS connections would be unavailable or untrusted. The only visible HTTP response returns the page title “Just a moment…”, a generic placeholder often observed on sites that have been seized or are in the process of being taken down.

The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal has recorded detections from seven of ninety‑three scanners, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The registrar listed is NiceNIC International Group Co., Limited. The threat is categorized as generic phishing, with an elevated risk rating.

Because the site is offline, active exploitation cannot be confirmed, but the infrastructure signals a typical phishing staging environment: rapid registration, Cloudflare front‑end, and low trust metrics. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare nameservers, and add the IP address 104.21.70.165 to any existing deny lists. Incident response teams should also verify whether any recent phishing emails reference this domain, and if so, correlate user reports with the timestamp of the domain’s creation. Ongoing observation is advised in case the site is re‑activated, at which point a full content analysis would be required.