tr[.]madridbetgirisleri[.]org

This domain, tr.madridbetgirisleri.org, is identified as a credential theft phishing site designed to harvest user login credentials under the guise of MadridBet, a recognized betting platform. Analysis indicates no direct evidence of a crypto drainer kit or payment skimming, but the site’s structure and content are consistent with credential harvesting tactics. The domain mimics legitimate login portals to deceive users into submitting sensitive account information, which is then likely exfiltrated to attacker-controlled servers. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 9 out of 95 security vendors on VirusTotal, signaling widespread detection as malicious. It is registered through Dynadot Inc and resolves to the IP address 130.12.180.242, a host with no prior association with the legitimate MadridBet brand. The domain was created on May 30, 2026, an anomalous future date suggesting potential registration system manipulation or typo-squatting. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. The SSL certificate is issued by ZeroSSL, a provider frequently used in low-reputation or short-lived phishing campaigns. The site is currently offline, likely due to takedown actions or domain suspension. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to its removal. Historical DNS records and cached content could still pose a threat if accessed through unsecured networks or compromised local resolvers. Organizations are advised to block the domain and associated IP at the perimeter, while users should verify the authenticity of betting platforms through official channels. Continuous monitoring of related infrastructure is recommended, as threat actors often re-deploy similar domains under new registrations.