m[.]madridbetgo[.]co

This domain, m.madridbetgo.co, is actively engaged in credential theft operations targeting users of online betting platforms. Analysis indicates the site mimics legitimate betting services to harvest login credentials, payment details, and personal information. The infrastructure is designed to deceive users into entering sensitive data under the pretense of account verification or promotional offers, which are then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals the domain was registered on May 31, 2026, through Dynadot Inc, an unusual future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 130.12.180.242, hosted on AS202412 (Omegatech LTD) in Germany, a network previously associated with malicious activity. The domain is flagged by 4 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate, issued by ZeroSSL RSA Domain Secure Site CA, provides a false sense of legitimacy while failing to mitigate the underlying threat. Users who have visited m.madridbetgo.co or entered credentials on the site should immediately revoke any submitted information. Reset passwords for all accounts where the same credentials may have been reused, prioritizing financial and email accounts. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor accounts for unauthorized transactions or login attempts, and report any suspicious activity to the affected platform. If payment details were entered, contact financial institutions to initiate fraud protection measures. The domain remains active as of this report, and users are advised to avoid interaction with any subdomains or related URLs.