extrabetturkiyegiris[.]com

This domain, extrabetturkiyegiris.com, is identified as a credential theft phishing site designed to harvest user login details by impersonating online betting services. Analysis indicates the site mimics legitimate betting portals, likely targeting users seeking access to platforms with restricted regional availability. No explicit crypto drainer kit signatures were observed, but the infrastructure aligns with credential harvesting tactics commonly deployed in gambling-related fraud schemes. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.199.247, which has been linked to other transient phishing campaigns. Security vendor detections on VirusTotal stand at 3/95, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was flagged in a single AlienVault OTX threat intelligence pulse. A Let's Encrypt SSL certificate is present, providing superficial legitimacy to unsuspecting users. The page currently returns a 520 error, suggesting server-side misconfiguration or takedown efforts. As of the latest assessment, extrabetturkiyegiris.com has been taken offline, though residual risk remains due to the domain's recent registration and prior malicious activity. The registrar and hosting provider have not issued public statements regarding enforcement actions. Users who may have interacted with the site are advised to rotate credentials for any associated accounts, particularly those linked to financial or betting services. Organizations should monitor network traffic for connections to 172.67.199.247 and update blocklists to include this domain and its associated indicators of compromise.