tr[.]galabet-girisone[.]vip

Analysis of tr.galabet-girisone.vip shows a recently registered domain (created 06 Mar 2026) that was hosted behind Cloudflare's network (ASN 13335) and resolved to IP 188.114.97.3 in the United States. The domain is configured with Cloudflare nameservers (june.ns.cloudflare.com, steven.ns.cloudflare.com) and presents a Let's Encrypt certificate (E8). An HTTP request to the site returned a 403 status and the page title "Attention Required! | Cloudflare," indicating that the site is currently inaccessible or protected by Cloudflare's challenge page.

VirusTotal scans recorded 13 detections out of 94 security vendors, and the domain appears on a single external blocklist, specifically PhishDestroy. Registration was performed through NameCheap, Inc. The observed indicators point to a crypto gambling phishing operation, consistent with the supplied scam type. While the site is offline, the infrastructure clues—including Cloudflare fronting, a recent registration date, and multiple vendor detections—suggest a short‑lived campaign aimed at luring victims into fraudulent gambling services.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the Cloudflare title has been captured. Defenders should continue to block the domain at perimeter filters, monitor for related C2 infrastructure on the same IP range, and add the domain to internal threat‑intel feeds. Ongoing observation of NameCheap registrations for similarly patterned domains and periodic re‑resolution checks are recommended to catch any re‑activation attempts.