marsbahis[.]com

Analysis of the domain marsbahis.com indicates active credential-phishing infrastructure targeting users of an online betting platform. The domain was registered on April 28, 2026, through Tucows Domains Inc. and currently resolves to the IP address 149.202.214.142, hosted on OVH infrastructure in France. DNS resolution is managed via four AWS nameservers: ns-1499.awsdns-59.org, ns-1540.awsdns-00.co.uk, ns-518.awsdns-00.net, and ns-23.awsdns-02.com. The site returns an HTTP 301 redirect, suggesting an attempt to forward visitors to an operational phishing endpoint. SSL encryption is provided by a Let's Encrypt certificate (serial E8), which does not inherently indicate malicious intent but is commonly exploited in phishing campaigns due to its low-cost availability. The page title, 'Marsbahis Giriş - Marsbahis Güncel Adres ve Üyelik,' explicitly references login and membership access for a platform named Marsbahis, implying an intent to harvest credentials from users attempting to access this service. As of July 12, 2026, the domain is flagged by one security vendor on VirusTotal and appears on a single blocklist, specifically PhishDestroy. AlienVault OTX records the domain in one threat intelligence pulse, confirming its presence in active threat tracking systems. No additional details regarding the phishing kit, targeted brand infrastructure, or specific lure tactics are currently available. Defenders should treat this domain as high-risk due to its confirmed presence on security blocklists and its association with credential-phishing activity. Network-level blocking of 149.202.214.142 and the domain itself is recommended. Security teams should monitor for connections to this infrastructure, particularly from systems associated with online betting or financial services. Given the domain's recent registration and active status, further monitoring of related DNS and WHOIS changes is advised to track potential shifts in hosting or ownership.