glorybet77-aamp[.]xyz

The domain glorybet77-aamp.xyz is currently active and classified as a high‑risk brand‑impersonation site targeting Google. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc., and is hosted in the United States. The authoritative nameservers are ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s edge network and benefits from services such as HSTS, HTTP/3, and automatic TLS provisioning. The presented SSL certificate is issued by Google Trust Services / WE1, which may mislead users into believing the site is legitimate. HTTP responses return a 308 permanent redirect, and the underlying stack is identified as Node.js running React and Next.js with AMP support, bundled by Webpack. The page title observed is "GLORYBET77 : Bandar Online Pilihan Terbaik Pemula Super Lengkap," which does not reference the impersonated brand and suggests the site is being used for a tech‑support scam. VirusTotal analysis shows six of ninety‑five security vendors flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain is already listed on at least one security blocklist and has been blocked by PhishDestroy. Although the exact phishing page content has not been examined, the combination of a Google‑issued certificate, Cloudflare‑provided hosting, and a redirect response strongly indicates an attempt to lure victims into a credential‑harvesting flow. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat intelligence feeds. Continuous re‑scanning with multi‑engine services is advised to detect any changes in malware payloads or hosting infrastructure.