gobahis-vip[.]icu

This domain, gobahis-vip.icu, is actively engaged in credential harvesting phishing campaigns designed to deceive users into submitting sensitive login details, financial information, or personal data. Analysis indicates the site employs social engineering tactics, likely mimicking legitimate platforms to trick visitors into entering credentials or other confidential information. The infrastructure is structured to evade initial detection while maintaining operational persistence, a common characteristic of high-risk phishing domains. Infrastructure analysis reveals the domain was registered on June 17, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with newly created phishing domains. It resolves to the IP address 104.21.15.97, which is part of a network range known for hosting malicious or suspicious content. As of the latest assessment, only 1 out of 95 security vendors on VirusTotal have flagged this domain, suggesting it remains under the radar for most detection systems. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site’s content or intent. Users who have visited gobahis-vip.icu or entered information on the site should take immediate action to mitigate potential risks. First, any credentials or sensitive data submitted should be considered compromised and changed immediately across all platforms where the same information may have been reused. Second, affected users are advised to monitor their accounts for unauthorized activity, including financial transactions or identity-related anomalies. Finally, security controls such as endpoint protection and network-level blocking should be updated to include this domain and its associated IP address to prevent further exposure. Given the domain’s active status and low detection rate, heightened vigilance is recommended for individuals or organizations that may have interacted with it.