marsbahis-girisin[.]icu

Analysis of marsbahis-girisin.icu shows an active infrastructure serving a generic phishing page. The domain resolves to 104.21.15.164, a Cloudflare‑owned address located in Canada, and uses the authoritative nameservers john.ns.cloudflare.com and sue.ns.cloudflare.com. TLS is provided by Google Trust Services under the WE1 certificate, while HTTP requests return a 403 status and a page title of "Just a moment...". The registration was processed through Fewmoretaps OU d/b/a Trustname.com. Threat intelligence indicates the domain has been blocked by PhishDestroy, appears on a single security blocklist, and one of ninety‑one VirusTotal scanners flagged it. Risk is assessed as high, and the domain remains active. Current evidence does not reveal the specific target brand or the exact phishing payload, so the precise scam mechanism is uncertain. Defenders should immediately block traffic to marsbahis-girisin.icu at network and DNS layers, monitor for any related C2 patterns tied to the Cloudflare IP range, and update detection rules to capture the 403 response with the "Just a moment..." title. Continuous re‑evaluation is advised as further content becomes available.