site38[.]madritbet3000[.]com

This domain, site38.madritbet3000.com, is confirmed as an active credential phishing site impersonating Madridbet, a known online betting platform. The threat specifically targets user login credentials and financial information through fraudulent login portals. Infrastructure analysis indicates the domain remains operational and continues to host malicious content designed to deceive victims. Technical indicators reveal the domain was registered on June 20, 2026, through Dynadot Inc. It resolves to the IP address 188.114.96.3 and is currently flagged by 5 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. The domain appears on one security blocklist, and its page title explicitly displays 'Madridbet,' reinforcing the impersonation attempt. Detection rates remain low, suggesting the campaign is either new or evading automated defenses through obfuscation techniques. The domain is classified as elevated risk due to its active status and direct targeting of financial credentials. Organizations and users are advised to block the domain at the network level and add it to endpoint protection denylists. Security teams should monitor for related infrastructure, including the IP address and registrar, for additional malicious domains. Users who may have interacted with the site should reset credentials immediately, enable multi-factor authentication, and review accounts for unauthorized activity. Proactive threat hunting is recommended to identify potential lateral movement or follow-on attacks stemming from compromised credentials.