matbet9905[.]icu

The domain matbet9905.icu was registered on July 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its authoritative name servers are pam.ns.cloudflare.com and ryan.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s CDN and DDoS protection service. DNS resolution points to the IPv4 address 104.21.27.64, a Cloudflare edge node that is shared by many unrelated sites, which complicates direct host attribution. The domain has been flagged by the PhishDestroy blocklist and currently appears on one additional security blocklist, yet the blocklist entry still lists the domain as active, confirming that the malicious infrastructure remains reachable.

VirusTotal records show that the domain was examined by 91 scanning engines; none of the engines reported a detection at the time of analysis. The absence of detections does not constitute evidence of benign intent, especially given the recent creation date and the presence of external blocklist entries. No public SSL certificate details, HTTP status codes, or page‑title information have been disclosed, leaving the exact content of the site unverified. Consequently, the precise phishing lure or targeted brand cannot be confirmed from the available data.

Given the combination of recent registration, Cloudflare front‑end, blocklist inclusion, and the generic phishing classification, defenders should treat matbet9905.icu as a high‑confidence phishing indicator. Recommended mitigations include adding the domain to network‑level deny lists, configuring DNS sinkhole rules, and monitoring outbound connections for attempts to resolve or contact the IP address 104.21.27.64. Continuous re‑scanning of the domain on VirusTotal and periodic checks of its blocklist status are advised to detect any evolution of the payload or changes in detection outcomes.