bahis[.]llc

Analysis on bahis.llc shows the domain is actively used for generic phishing as of 25 July 2026. The domain is delegated to Cloudflare name servers newt.ns.cloudflare.com and adele.ns.cloudflare.com, indicating the infrastructure is hosted behind Cloudflare’s CDN and DDoS protection services. Registration records list Spaceship, Inc. as the registrar; no additional registrant details are disclosed. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy feed, confirming that threat intelligence communities have observed malicious activity associated with it.

VirusTotal scans returned four positive detections out of ninety‑one submitted security engines, providing independent corroboration of the malicious classification. An HTTP request to the root URL returns a 403 Forbidden response, which is consistent with a server configured to block direct access while likely serving phishing content through crafted URLs or redirects. The domain remains marked as active, meaning the underlying infrastructure is still reachable and may be used in ongoing campaigns. No public page title, SSL certificate details, or explicit brand impersonation have been released, so the exact lure employed by the site cannot be confirmed at this time.

The lack of visible content suggests the operator may be using dynamic payload delivery or short‑lived URLs that evade static analysis. Defenders should continue to block bahis.llc at the DNS and proxy layers, monitor outbound connections to the associated Cloudflare edge IP ranges, and incorporate the domain into existing phishing detection rules. Additional scanning of the domain with sandbox environments is recommended to capture any payloads that may be served after the initial 403 response. Ongoing observation of the PhishDestroy feed and other blocklists will provide updates should the threat actor alter the hosting configuration or expand the campaign.