tr[.]madridbetteyiz[.]co

This domain, tr.madridbetteyiz.co, is flagged as a generic phishing site targeting user credentials. Analysis of the infrastructure reveals no direct association with a specific brand or drainer kit, though the naming convention suggests potential impersonation of regional or organizational entities. The domain exhibits characteristics consistent with opportunistic phishing campaigns designed to harvest login details or personal information. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 31, 2026, through Dynadot Inc and currently resolves to the IP address 130.12.180.239, hosted on AS202412 (Omegatech LTD) in Germany. Detection metrics indicate a VirusTotal score of 3/95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. The SSL certificate is issued by ZeroSSL, specifically the ZeroSSL RSA Domain Secure Site CA. As of the latest verification, tr.madridbetteyiz.co remains active and continues to host phishing content. Response actions should include immediate blocking of the domain and IP address within network security controls, as well as monitoring for related infrastructure registered through the same registrar or hosted on the same autonomous system. Despite its low detection count, the domain poses a high risk due to its operational status and targeted nature. Organizations are advised to alert users, update endpoint protection rules, and conduct retrospective analysis to identify any prior interactions with this infrastructure.