pusulabetaktif[.]icu

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is designed to mimic legitimate authentication portals, tricking victims into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The threat type is classified as generic_phishing with a focus on credential theft, which may lead to unauthorized account access, financial fraud, or further lateral movement within compromised networks. Infrastructure analysis reveals the domain pusulabetaktif.icu is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on July 02, 2026, suggesting a recently established malicious operation. It resolves to the IP address 188.114.96.3 and is currently active. The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 4 out of 95 security vendors flagging this domain as malicious. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users while failing to mitigate the underlying phishing threat. Mitigation requires immediate action to prevent credential compromise. Network administrators should block the domain pusulabetaktif.icu and its resolving IP 188.114.96.3 at the firewall and DNS levels. Endpoint protection solutions should be updated to include this domain in phishing and malicious URL databases. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, with priority given to financial, email, and corporate systems. Security teams should monitor for anomalous authentication attempts, particularly from the IP 188.114.96.3, and review logs for signs of credential reuse or unauthorized access originating from this threat vector.