ultrabet-girisimiz[.]vip

Analysis of ultrabet-girisimiz.vip indicates a high‑confidence malicious infrastructure supporting a crypto gambling phishing campaign. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently offline. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. Both authoritative nameservers—nicolas.ns.cloudflare.com and dana.ns.cloudflare.com—are Cloudflare‑managed, and the site employs Cloudflare Browser Insights and HTTP/3, confirming reliance on Cloudflare services.

The site presented the page title "Kavbet - Kavbet Giriş Rehberi | Hızlı Erişim ve Akıcı Oyun Deneyimi," aligning with the declared scam type of crypto gambling and indicating an attempt to lure users seeking rapid access to betting platforms. The SSL certificate is issued by Google Trust Services under the WE1 root, providing standard TLS encryption but not mitigating malicious intent. HTTP responses return a 523 status, suggesting Cloudflare‑origin server unavailability, which is consistent with the reported offline status. Threat intelligence shows that two of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extreme lack of reputation.

The domain appears on one security blocklist and has been actively blocked by PhishDestroy. Defenders should continue to block the domain at perimeter and DNS filters, monitor for any re‑hosting attempts using the same IP range, and consider adding the associated IP address to threat intel feeds. Observations of the domain’s registration timeline, Cloudflare hosting, and low trust scores substantiate its classification as a crypto gambling phishing operation, and preventative controls should remain in place pending any re‑emergence.