bahis-2026[.]com

bahis-2026.com is currently listed on the PhishDestroy blocklist as a generic phishing site. The domain was registered on March 06, 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 199.177.183.251, which geolocates to Germany. The name servers cheryl.ns.cloudflare.com and norman.ns.cloudflare.com indicate that the domain is hosted behind Cloudflare’s DNS service, a common choice for threat actors seeking to hide origin infrastructure. No TLS certificate is presented for the host, meaning HTTPS connections are not available; the site is reachable only via HTTP, and its current HTTP status is offline.

The only page title observed before takedown was “DDoS Koruma Doğrulaması”, a Turkish phrase meaning “DDoS Protection Verification”, suggesting the phishing lure may have been framed as a verification step for DDoS protection services. VirusTotal analysis shows that one of ninety‑four scanning engines flagged the domain, providing additional confirmation of malicious intent. The domain appears on a single public blocklist, PhishDestroy, and no other intelligence sources such as OTX or Safe Browsing are referenced in the supplied data.

Defenders should add the domain and its resolving IP to network deny lists, enforce DNS sinkholing for the associated Cloudflare name servers, and monitor for any future re‑registration attempts. Because the site is already offline, immediate incident response actions are limited to containment of any cached or lingering references in internal logs and ensuring that email filters continue to block messages containing the domain. Continuous review of the registrar’s activity and periodic rescanning of the IP address are recommended to detect possible reuse.