giris5[.]madritbet3003[.]com

Analysis as of July 23, 2026 indicates that the domain giris5.madritbet3003.com was registered through Dynadot Inc. on June 22, 2026. The site resolved to the Cloudflare‑owned address 172.67.144.164, which is announced by AS13335 and geolocated to the United States. Cloudflare services are confirmed by the presence of Cloudflare Browser Insights, the Cloudflare header, and the use of HTTP/3. The domain’s authoritative nameservers are danica.ns.cloudflare.com and rommy.ns.cloudflare.com, consistent with the observed hosting. The page title returned from the live endpoint before takedown was “Madridbet”, suggesting an attempt to impersonate a betting brand, although the content of the page has not been publicly disclosed.

VirusTotal scanned the domain and recorded four positive detections out of ninety‑one submitted security vendors, indicating that multiple anti‑malware engines have flagged the host as malicious. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, reinforcing its classification as a phishing infrastructure. Current network probing shows the host is offline, and no HTTP response was received at the time of testing. No SSL certificate details beyond the default Cloudflare issuance are available, and Safe Browsing or Open Threat Exchange entries were not observed in the supplied intelligence.

Consequently, the confidence in the phishing attribution rests on the vendor detections, blocklist inclusion, and the “Madridbet” page title. Defenders should add giris5.madritbet3003.com to internal blocklists and ensure that any outbound connections to the IP 172.67.144.164 are denied. Monitoring for newly created subdomains under the same registrar (Dynadot) or similar naming patterns is advisable, as the short lifespan of the domain suggests a rapid‑deployment campaign.