bul-parmabet[.]icu

This domain is flagged as a credential harvesting site under investigation, specifically targeting users of online betting platforms. Analysis indicates the infrastructure is designed to mimic legitimate betting services, tricking victims into submitting account credentials, payment details, or personal information through fraudulent login portals. Infrastructure analysis reveals the domain bul-parmabet.icu was registered on June 20, 2026, through Fewmoretaps OU d/b/a Trustname.com. It currently resolves to IP address 172.67.183.41 and uses an SSL certificate issued by Google Trust Services, providing a false sense of security. As of the latest scan, the domain has 0/95 detections on VirusTotal, meaning no security vendors have flagged it yet. No blocklist entries or trust score downgrades have been recorded, allowing the site to remain operational and undetected by most automated defenses. Mitigation steps for this threat include immediate blocking of the domain and IP address at the network perimeter. Organizations should monitor for outbound connections to 172.67.183.41 and alert on any attempts to access bul-parmabet.icu. End users should be educated to verify domain authenticity before entering credentials, especially on betting or financial sites. Security teams are advised to check logs for successful connections to this domain and reset credentials if exposure is confirmed. Given the lack of detections, manual verification and proactive hunting are critical to detect and disrupt this campaign.