tr[.]bahiscasino-guncelgiris[.]org

As of the report date of July 24, 2026, the domain tr.bahiscasino-guncelgiris.org has been identified and classified as a crypto gambling scam. The domain has been flagged by 8 out of 95 security vendors on VirusTotal, indicating a notable level of suspicion among the security community. The SSL certificate for this domain was issued by Google Trust Services, which typically provides reliable security, but the presence of a certificate does not preclude the domain from engaging in malicious activities. The IP address associated with the domain is 104.21.5.120, located in the United States and hosted by Cloudflare, Inc. (AS13335). This suggests the use of a reputable cloud hosting service to mask the true origin of the scam, a common tactic in phishing campaigns.

The domain is currently offline, returning an HTTP 403 status code, which typically indicates that access to the requested resource is forbidden. Nameservers for the domain are brady.ns.cloudflare.com and erin.ns.cloudflare.com, further confirming the use of Cloudflare infrastructure. Additionally, tr.bahiscasino-guncelgiris.org appears on one security blocklist, specifically PhishDestroy, enhancing the credibility of the classification as a scam site.

The domain was registered through Gname.com Pte. Ltd. on November 29, 2025. While the exact content of the site is not yet analyzed, the page title 'Just a moment...' suggests that the site may have been temporarily down or actively using a holding page to evade detection at the time of analysis. The use of HTTP/3 is noted, which may indicate a more modern and potentially sophisticated web infrastructure.

Given the elevated risk level and the current offline status, network defenders and security teams are advised to block this domain to prevent any potential exposure to crypto gambling scams. Regular monitoring and updates to security blocklists should be conducted to ensure ongoing protection.