madrid[.]bet-gogo[.]mobi

Analysis of the domain madrid.bet-gogo.mobi as of July 24, 2026 indicates that the site was associated with a generic phishing campaign and is presently offline. The authoritative name servers are bella.ns.cloudflare.com and dexter.ns.cloudflare.com, confirming the use of Cloudflare's DNS service. DNS resolution returned the IPv4 address 130.12.180.242, which is registered to AS202412 Omegatech LTD and geolocated to Germany. The hosting provider is therefore likely operating out of the DE region.

An SSL certificate issued by Let’s Encrypt (identifier YE1) was active, indicating that HTTPS was available at the time of observation. Threat intelligence sources have recorded three positive detections out of ninety‑one vendors on VirusTotal, and the domain appears on a single security blocklist. The Gridinsoft trust score of 0 / 100 further reflects a high confidence of malicious intent. PhishDestroy has already blocked the domain, and the page title returned by the HTTP response matches the domain string itself, suggesting no additional branding was presented.

Because the site is currently taken offline, active probing is not possible, and the exact content of the page remains unverified. Nevertheless, the combination of low trust score, multiple vendor detections, and inclusion on a blocklist provides sufficient justification for defensive actions. Organizations should ensure that the domain and its resolving IP address are added to local deny lists, update URL filtering policies, and monitor for any future re‑registration of similar sub‑domains. Continuous observation of the associated ASN (AS202412) for new phishing‑related activity is also recommended.