kingsroyals-en-gunceli[.]icu

This domain, kingsroyals-en-gunceli.icu, is flagged as an active credential theft operation targeting users of the Kingroyal betting platform. Analysis of the page title, 'Kingroyal: Güvenli ve Lisanslı Bahis Platformu - Kingroyal Giriş,' confirms the site is impersonating the legitimate Kingroyal brand to deceive visitors into submitting login credentials. No crypto drainer or wallet-stealing scripts were observed in initial scans, but the infrastructure aligns with credential harvesting campaigns targeting online gambling users in Turkish-speaking regions.

Technical indicators reveal the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.138.202, hosted on a content delivery network that obscures origin infrastructure. VirusTotal reports 0 detections out of 95 engines, indicating low initial detection rates. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse (seed fc8dac). Google Safe Browsing status remains unflagged at the time of analysis.

Current status shows the site remains active and accessible, with no takedown or sinkholing observed. The low detection rate and use of a content delivery network suggest the threat actor is attempting to evade automated detection while maintaining operational uptime. Users are advised to verify domain authenticity before entering credentials, particularly for financial or gambling platforms. Organizations should monitor for credential reuse attempts stemming from this campaign, as harvested data is likely to be exploited in follow-on attacks or sold on underground markets.