tr[.]madridbet-gir[.]onl

This domain, tr.madridbet-gir.onl, was identified as a credential phishing site targeting users of the MadridBet brand, based on its page title and domain naming convention. Analysis indicates the domain is currently offline, with no active HTTP responses detected as of July 24, 2026. Infrastructure analysis reveals the domain resolved to IP address 130.12.180.243, hosted on AS202412 (Omegatech LTD) in Germany. The domain was registered through Dynadot Inc and uses Cloudflare nameservers (clay.ns.cloudflare.com and tani.ns.cloudflare.com), a common configuration for both legitimate and malicious sites.

Security vendor detections remain limited but notable: three of 91 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further indicating high suspicion. The SSL certificate, issued by Let's Encrypt (serial YE2), provides encryption but does not validate the site's legitimacy, as phishing domains frequently use free certificates to appear trustworthy. While the domain's exact content and phishing kit are not yet analysed, the combination of brand-targeted naming, low trust scores, and security vendor detections strongly suggests a credential harvesting operation.

Defenders should treat this domain as a confirmed phishing threat, particularly for users of MadridBet or similar platforms. Monitoring for re-activation or related domains under the same IP, ASN, or registrar is recommended. If the domain resurfaces, immediate takedown requests should be submitted to the hosting provider (Omegatech LTD) and registrar (Dynadot Inc).