biabettelegram[.]com

This domain, biabettelegram.com, is flagged as an active high-risk brand impersonation site targeting Amazon users. Registered on August 12, 2025, through Key-Systems GmbH, the domain currently resolves to 104.21.17.10, a Cloudflare IP address (AS13335) located in the US. The page title, 'biabet -Biabet - Güvenilir Bahis Sitesi | Biabet TV ve Telegram,' suggests a gambling or betting platform, which contradicts the reported impersonation of Amazon. This discrepancy indicates either a misclassified threat or a deliberate attempt to obfuscate the site's true purpose under a seemingly unrelated front. Infrastructure analysis reveals the use of Cloudflare nameservers (cash.ns.cloudflare.com, meiling.ns.cloudflare.com) and technologies such as Tailwind CSS, jsDelivr, and HTTP/3. The domain holds a valid SSL certificate issued by Google Trust Services (WE1) and returns an HTTP 200 status, confirming its operational status as of July 12, 2026. Despite its active state, the domain appears on only one security blocklist and is flagged by a single security vendor on VirusTotal, indicating limited detection at this stage. The Gridinsoft trust score of 0/100 further supports its classification as malicious. The scam type is identified as e-commerce, though the page title does not explicitly reference Amazon or any retail-related content. This inconsistency may stem from incomplete analysis or a dynamic page structure designed to evade detection. Defenders should prioritize blocking the domain and its associated IP (104.21.17.10) at the network level, particularly in environments where Amazon-related phishing poses a risk. Monitoring for similar domains registered through Key-Systems GmbH or leveraging Cloudflare infrastructure may help identify related threats. Given the domain's recent creation and low detection rate, additional scrutiny of its traffic patterns and user interactions is recommended to assess its impact and evolution.