galabeton[.]com

The domain galabeton.com was registered through GoDaddy.com, LLC on March 02, 2026 and is currently active. DNS resolution returns the Cloudflare‑owned address 172.67.133.10, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and it serves HTTP status code 301, indicating a permanent redirect. The page title retrieved from the server reads “Galabet 882 giriş adresi - Galabet 883 yeni - Galabet 884 güncel linkten bahis yap!”, which aligns with a crypto‑gambling narrative rather than a legitimate Twitter login page.

The infrastructure is identified as a brand‑impersonation campaign targeting Twitter, as indicated by the intelligence tag “Impersonates: twitter”. The domain is listed on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain, demonstrating a moderate detection rate. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating.

The active use of Cloudflare’s HTTP/3 protocol and the presence of the nameservers jasper.ns.cloudflare.com and naomi.ns.cloudflare.com confirm that the attacker is leveraging reputable CDN services to obscure origin details. While the page title and vendor detections provide strong evidence of a crypto‑gambling scam masquerading as a Twitter impersonation, the exact content and credential‑capture mechanisms have not been publicly disclosed. Defenders should block the domain at DNS and proxy layers, monitor for any related IP or nameserver activity, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of the associated IP address and any future VirusTotal or blocklist updates is recommended to track potential escalation.