tr[.]canligalabetgiris[.]live

The domain tr.canligalabetgiris.live is identified as a credential theft operation specifically targeting users of the Galabet platform. Analysis of the page title, "Galabet - Galabet Canlı Giriş Rehberi - Güncel Girişin Tek Adresi - Lütfen doğru sayfada olduğunuzdan emin olun," confirms the intent to impersonate the legitimate Galabet service to harvest user credentials. The domain is currently offline, but prior activity indicates a focused campaign to deceive users into submitting sensitive login information under false pretenses.

Technical indicators reveal multiple red flags associated with this domain. It is flagged by 15 of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The domain resolves to the IP address 172.67.172.17 and employs Cloudflare infrastructure, including Cloudflare Browser Insights and HTTP/3, which are often leveraged to obscure malicious activity. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 18, 2026, the domain exhibits an anomalous creation date, suggesting potential misuse of registration processes. Additional risk factors include a Gridinsoft trust score of 0/100, further corroborating its malicious classification.

Given the elevated risk level and confirmed credential theft intent, users are advised to treat this domain as highly dangerous. Organizations should update security controls to block access to tr.canligalabetgiris.live and its associated IP address. Users who may have interacted with the domain should immediately reset their Galabet credentials and monitor accounts for unauthorized activity. Security teams are recommended to review logs for connections to 172.67.172.17 and implement detection rules for similar impersonation domains targeting regional platforms.