GHOST STADIUM phishing (TA-1)
Hosting provider / shared infra
Staging IP (89.208.250[.]38)
dk9873 persistent layer (MODERATE)
HK betting operation (separate)
Vigorish Viper baowang (supply)
Recycled-domain farm (AS142286 · separate leg)
KEY: bybanking[.]com shared DNS control
Phishing & betting clusters share 0 of 18,860 certificates · attributed separately (shared kit ≠ shared operator).
Source: CrimsonVector · Group-IB GHOST STADIUM IOCs (verified), Silent Push passive DNS, Shodan, Team Cymru ASN, active DNS · IOCs defanged · confidence calibrated · CrimsonVector 2026