iptvsport[.]net

iptvsport.net was registered on 2026-03-06 through ENOM, INC. The domain is currently active and resolves to the IPv4 address 185.192.125.137. Both authoritative name servers, ns1.iptvsport.net and ns2.iptvsport.net, are hosted under the same domain, suggesting the operator controls the full DNS zone. No detections have been reported on VirusTotal (0/95 scans), indicating that the site has not yet been flagged by public scanners, but the absence of detections does not imply benign intent.

The domain has been classified as a generic_phishing infrastructure. Although the public web content was not provided, the combination of a recently created domain, dedicated name servers, and the active status aligns with typical phishing deployment patterns where attackers use short‑lived domains to host credential‑harvesting pages. The IP address 185.192.125.137 is publicly routable and does not belong to a known cloud‑provider block, which may indicate the use of a residential or VPS hosting service to reduce attribution risk.

Current intelligence lacks details on the specific phishing campaign, target brand, or malicious payload. No malware hashes, URL snapshots, or email samples have been linked to the domain, leaving the exact phishing vector uncertain. The registrar ENOM, INC. is a popular service for both legitimate and malicious actors, and the use of self‑hosted name servers could be an attempt to avoid registrar‑level takedown. Observers should watch for any future association of the domain with phishing emails, credential‑stealing pages, or redirects to known malicious repositories.

Defenders are advised to block traffic to iptvsport.net and to the IP 185.192.125.137 at network perimeter devices. Continuous monitoring of DNS queries for the domain and its name servers should be instituted, and any sighting of related phishing content should be reported to relevant abuse contacts. Because the infrastructure is still under investigation, threat hunters should include the domain in indicator‑of‑compromise (IOC) sets and correlate it with endpoint logs to detect potential exploitation.