m-tikobet388[.]com

On 24 July 2026 the domain m-tikobet388.com was observed to host a crypto‑gambling phishing page titled “TikoBet - Tik Yatır Tik Kazan Tik ÇEK!”. The site was registered on 22 February 2026 through NiceNIC International Group Co., Limited and uses the Cloudflare nameservers aida.ns.cloudflare.com and bowen.ns.cloudflare.com. DNS resolution points to the IP address 172.67.131.145, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate was presented, indicating the service was delivered over plain HTTP before being taken offline. VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines, and the domain appears on a single external blocklist.

The phishing infrastructure was also flagged by the PhishDestroy platform. The three vendor detections were contributed by reputable security engines, reinforcing the malicious classification despite the low overall count. The single blocklist entry originates from a community‑maintained phishing blacklist. The page’s content suggests a cryptocurrency gambling lure, consistent with the “Crypto Gambling” classification in the intelligence feed. The available evidence confirms that the domain was actively used for phishing as of early 2026, but the current offline status prevents further content analysis.

Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering rules, and monitor for future registrations that reuse the same registrar or Cloudflare name servers. Threat‑intel teams may also query passive DNS feeds for any additional CNAME or A‑record changes that could indicate re‑activation. Because the site leveraged a reputable CDN provider, similar abuse may surface from other Cloudflare‑hosted domains, so applying broader Cloudflare‑associated outbound filtering can reduce exposure.