89028[.]xyz

This domain, 89028.xyz, is flagged as a brand-impersonation threat specifically targeting Bet365, a well-known online gambling platform. Analysis of the page title, 'welcome-BET365,' confirms the domain’s intent to deceive users by mimicking the legitimate Bet365 interface, likely to harvest login credentials or financial information. No evidence of a drainer kit was observed, but the absence of SSL encryption and the use of a generic welcome page suggest a low-effort yet effective phishing operation designed to exploit unsuspecting users. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 103.59.145.11, hosted under AS133861 (SonderCloud Limited), with a geolocation in the United States. It was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate gambling platforms. VirusTotal detection rates show 20 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Notably, the domain lacks SSL certification, a critical red flag for any site handling user credentials or financial transactions. As of the latest assessment, 89028.xyz has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy. However, the elevated risk level persists due to the domain’s recent creation date and its association with a hosting provider frequently linked to fraudulent activity. Users who may have interacted with this domain are advised to reset credentials for Bet365 and monitor financial accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.