marsbahis-fly[.]icu

The domain marsbahis-fly.icu is classified as a high‑risk generic phishing site and remains active as of the report date, July 20 2026. Infrastructure analysis shows the domain is hosted behind Cloudflare, resolving to IP 188.114.96.3, which is situated in Canada and associated with Cloudflare, Inc. The authoritative nameservers are chan.ns.cloudflare.com and ken.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The domain is registered through Fewmoretaps OU d/b/a Trustname.com, a registrar that does not appear to be widely recognized in security circles. Web‑level observations reveal an HTTP 403 response code and an SSL certificate issued by Google Trust Services under the WE1 label, while the page title returned is the generic string “Just a moment…”. Threat intelligence indicates the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans report that three of ninety‑one security vendors flagged the domain, providing limited but non‑trivial detection evidence. The combination of a Cloudflare‑fronted IP, a generic page title, and minimal vendor detections suggests the operators are attempting to hide malicious content behind a standard “access denied” response, a pattern often observed in phishing‑hosting infrastructure. Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms employed, as no detailed page content or lure vector has been disclosed. Defenders should prioritize blocking DNS resolution for marsbahis-fly.icu, enforce SSL inspection to detect any concealed payload, and monitor outbound connections to the associated Cloudflare IP. Continuous re‑scanning on multi‑engine platforms is advised to capture any future changes in detection status, and the domain should be added to existing intrusion‑prevention and web‑filtering policies due to its high‑risk classification.