578metrobahis[.]com

The domain 578metrobahis.com was registered on February 22, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN13335) with the IP address 188.114.97.3 located in the United States. The domain uses Cloudflare nameservers coen.ns.cloudflare.com and gail.ns.cloudflare.com, but no SSL certificate was observed, indicating that HTTPS was not enforced at the time of analysis. The page title returned by the site, "1 yeni mesaj," suggests an attempt to lure Turkish‑speaking users, although the exact content of the page has not been examined.

Threat intelligence sources report that three of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single security blocklist that has been incorporated into the PhishDestroy blocking service. The domain’s current status is offline, which limits further direct observation. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any residual traffic to the associated IP address, and consider adding the IP to reputation lists.

Additional analysis is recommended if the site becomes active again, particularly to capture the full payload of the phishing page and to verify whether any credential‑stealing form is present. The limited detection history and recent registration date suggest a short‑lived campaign, but the use of Cloudflare and the lack of TLS underscore the need for vigilance against similar infrastructure‑based phishing attempts.