mostbet-uz-kirish-mostbet[.]com

This domain, mostbet-uz-kirish-mostbet.com, is identified as a phishing site impersonating a legitimate betting platform. Analysis indicates the site is designed to deceive users in Uzbekistan by mimicking the branding and interface of a known sports betting service, likely to harvest credentials or financial information. The page title, '⚡️ Mostbet UZ Kirish ᐉ ⬅️ bukmekerlik kontorasi bilan O'zbekistonda sport tikish,' reinforces the fraudulent intent by targeting local users with localized content. No specific drainer kit signatures were detected, but the use of WordPress and Cloudflare suggests an attempt to obfuscate malicious activity behind common infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 104.21.19.235 and was registered through NameSilo, LLC on April 24, 2026. The SSL certificate is issued by Google Trust Services, a common practice among phishing sites to appear legitimate. Detection metrics show 18 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Technologies detected include WordPress, MySQL, PHP, jQuery, HSTS, Google Analytics, Cloudflare Browser Insights, and Cloudflare, indicating a layered approach to both functionality and evasion. As of the latest assessment, the domain remains active and poses an elevated risk to users. The creation date discrepancy (registered in 2026) suggests domain spoofing or a typographical error in registration records, further complicating attribution. Response actions should include immediate blacklisting by network security providers and browser-based warnings for users attempting to access the site. Users are advised to verify the authenticity of betting platforms through official channels and avoid entering credentials or financial details on untrusted domains. The remaining risk is classified as elevated due to the domain's active status, localized targeting, and use of obfuscation techniques.