tr[.]madriidbet[.]mobi

The domain tr.madriidbet.mobi is currently active and poses a phishing threat by imitating the Madridbet brand. PhishDestroy flagged this domain on June 21, 2026, and it is already listed on one public blocklist, including PhishDestroy's own. The domain is hosted on IP 130.12.180.244, located in Germany, and registered through Dynadot Inc. It has a platform risk score of 71 out of 100, indicating a significant threat level.

Despite being flagged by only 1 out of 91 vendors on VirusTotal, the domain's activity is concerning, especially given its recent detection. The low number of VirusTotal detections suggests it is a fresh threat, exploiting the typical delay in antivirus database updates. This highlights the importance of early detection systems like PhishDestroy's, which can identify threats in their nascent stages before they propagate widely.

The site uses a Let's Encrypt SSL certificate, which is a common choice for malicious actors due to its ease of access and cost-effectiveness. The hosting organization, Omegatech LTD, under ASN AS202412, is based in Germany, adding a layer of complexity for tracking and mitigation efforts. The page title, "Madridbet: Madridbet Giriş Portalı - Madridbet 2026," indicates a direct attempt to deceive users into believing they are accessing a legitimate Madridbet portal.

This domain exemplifies the ongoing challenges in combating phishing threats, particularly those that leverage brand imitation. The combination of a high platform risk score and early detection by PhishDestroy underscores the need for proactive threat intelligence and swift action to protect potential victims.