son-pusulabet[.]mobi

The domain son-pusulabet.mobi has been identified as a phishing infrastructure specifically designed to impersonate online betting platforms. Analysis indicates this is a fake betting site phishing operation, likely targeting users with fraudulent login portals to harvest credentials or financial information. The domain is currently offline, though prior activity suggests it may have been operational during its active window. Infrastructure analysis reveals the domain was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to IP address 172.67.167.231, a Cloudflare-associated address that may have been used to obfuscate the true hosting origin. Created on April 04, 2026, the domain appears to have been established with a future activation date, a tactic sometimes used to evade initial scrutiny. It was listed on one security blocklist and received a Gridinsoft trust score of 0/100, further confirming its malicious classification. AlienVault OTX records show the domain was included in one threat intelligence pulse, suggesting limited but confirmed exposure in threat-sharing communities. Current status confirms the domain is offline, though the infrastructure may remain dormant for future reactivation. Organizations and users are advised to block the domain at the DNS level and monitor for related subdomains or newly registered lookalike domains. Network defenders should inspect logs for connections to 172.67.167.231 or requests to son-pusulabet.mobi, particularly from systems that may have interacted with betting or gambling platforms. End users should be educated on recognizing fake betting sites, including checking for SSL certificates, verifying domain registration dates, and cross-referencing official platform URLs. Given the elevated risk level, security teams are encouraged to treat any future activation of this domain as a potential credential theft or financial fraud event.