mrsbahis-guncel-gir[.]icu

The domain mrsbahis-guncel-gir.icu is currently active and resolves to the Cloudflare‑owned IP address 188.114.96.3, which is geolocated to Canada. DNS resolution is handled by chris.ns.cloudflare.com and gail.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known to host a variety of legitimate and illicit sites. An HTTP request to the domain returns a 403 status code and the page title "Just a moment...", a typical Cloudflare challenge page that obscures the underlying content. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a malicious resource. VirusTotal analysis shows that five of ninety‑one scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent. The SSL certificate presented is issued by Google Trust Services under the WE1 name, a common certificate for many Cloudflare‑protected sites and not indicative of benign or malicious behavior on its own. Evidence points to the domain being used for a generic phishing campaign, though the exact payload or targeted brand has not been disclosed. Defenders should treat the domain as high‑risk: block DNS resolution at the network perimeter, add it to URL filtering policies, and monitor for any outbound connections to the associated IP. Continuous re‑evaluation is advised, as the limited visibility of the underlying site means additional malicious activity could emerge without further forensic analysis.