m[.]wbahs[.]bet

On July 24, 2026, the domain m.wbahs.bet was observed to host a page titled "WBAHİS Uluslararası Lisanslı Bahis ve Casino Adresi!". The title directly references an international licensed betting and casino service, but analysis links the site to a crypto‑gambling phishing operation. The site was registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which belongs to AS13335 owned by Cloudflare in the United States. VirusTotal scanned the domain and recorded detections from 2 of 95 security vendors, indicating that at least a subset of engines consider the host malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the low reputation.

No SSL/TLS certificate was presented, meaning traffic to the site would be unencrypted. The underlying phishing kit has been identified as the "Gambler Scam" kit, a known template used to harvest credentials and lure victims into fraudulent gambling services. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one industry feed is distributing indicators for it. Because the host is currently offline, real‑time HTTP status could not be verified, but the offline state does not guarantee future inactivity. The limited number of vendor detections and the solitary blocklist entry suggest a modest distribution footprint, yet the combination of a zero‑trust score, unencrypted transport, and a targeted gambling phishing kit warrants a heightened precautionary posture.

Defenders should add m.wbahs.bet to URL filtering rules and block outbound connections to the IP 188.114.96.3. Monitoring for newly resolved subdomains under the same Cloudflare account is recommended, as the registrar can issue additional hosts with similar tactics.