manbetxss[.]com

Analysis confirms that manbetxss.com is an active malicious infrastructure supporting a gambling‑related phishing campaign. The domain was registered on March 05, 2026 through Dynadot LLC and resolves to the IP address 20.255.104.129, which belongs to Microsoft Corporation (AS8075) and is geolocated in Hong Kong. The site presents a 301 redirect and serves an SSL certificate issued by Let’s Encrypt (R13), indicating a short‑lived, cost‑effective setup.

The web front‑end is built with Bootstrap, Swiper, Moment.js, and jQuery, a combination frequently observed in low‑cost copy‑cat sites. Nameservers are cash.ns.cloudflare.com and lana.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The page title, "万博体育|五大联赛官方合作伙伴," translates to "Wanbo Sports | Official Partner of the Five Major Leagues," suggesting the actors are masquerading as a legitimate sports betting brand to lure victims.

Threat intelligence flags the domain as high‑risk. PhishDestroy has already blocked the site, and it appears on one public security blocklist. VirusTotal reports eight detections out of ninety‑five scanners, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The combination of a recent registration, Cloudflare‑hosted infrastructure, and a clear gambling‑related theme aligns with the generic_phishing label, but the specific lure appears to be a fake sports betting portal.

Defenders should immediately add manbetxss.com to URL filtering and DNS blocklists, monitor traffic to the associated IP 20.255.104.129, and enforce TLS inspection to capture any credential harvesting attempts. Given the use of Cloudflare DNS, threat‑hunting rules should also consider the domain’s authoritative nameservers. Continuous re‑evaluation is advised, as the actors may pivot to additional domains or alter the front‑end assets to evade detection.