kav-betgiris[.]vip

On July 23 2026 analysts observed that the domain kav-betgiris.vip is hosted behind Cloudflare (ASN13335) and resolves to IP 172.67.131.205, a location attributed to the United States. The site was registered on February 21 2026 through NiceNIC International Group Co., Limited and is secured with a Google Trust Services / WE1 SSL certificate, indicating the use of a legitimate certificate authority. HTTP probing returned a 523 status code, suggesting the origin server is unavailable, which aligns with the reported offline status. The infrastructure employs Cloudflare’s HTTP/3 protocol and is served by the authoritative nameservers stevie.ns.cloudflare.com and aaron.ns.cloudflare.com.

Reputation checks show the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans recorded three positive detections out of ninety‑three security vendors, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, and the page title "Kavbet - Kavbet Giriş Rehberi | Hızlı Erişim ve Akıcı Oyun Deneyimi" references the Kavbet brand, indicating a likely attempt to lure users seeking gambling services. The threat type is classified as generic phishing with a specific focus on crypto gambling, and the risk level is elevated.

While the domain’s content has not been directly inspected, the combination of a brand‑targeted title, low trust scores, multiple vendor detections, and blocklist presence suggests a fraudulent credential‑harvesting or financial‑extraction campaign. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and update internal blacklists. Ongoing observation is recommended to detect any re‑activation or changes in hosting that could indicate a shift in attack tactics.