y29h[.]top

This domain, y29h.top, is flagged as a generic phishing infrastructure designed to impersonate the legitimate BET365 betting platform. Analysis of the page title, "welcome-BET365," confirms the domain's intent to deceive users into believing they are accessing the official BET365 portal. While no drainer kit signatures were identified in the available data, the domain's structure and branding alignment strongly suggest it was engineered for credential harvesting or financial fraud targeting sports betting enthusiasts. Infrastructure analysis reveals the following technical indicators: the domain was registered through NameMart Pte. Ltd. on May 26, 2026, an anomalous future date likely indicative of falsified registration details. It resolves to the IP address 154.39.104.138, hosted on the China169 Backbone (AS4837) within China. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal. No SSL certificate was detected, further degrading its legitimacy. Google Safe Browsing status is not explicitly listed, but the domain's presence on a blocklist and its offline status suggest prior detection. As of the latest assessment, y29h.top has been taken offline, reducing immediate exposure risks. However, the domain's infrastructure remains a latent threat due to its unresolved registration and potential for reactivation. Users who may have interacted with this domain are advised to reset credentials for any associated accounts, particularly those linked to financial services. Organizations should monitor for similar domains registered through NameMart Pte. Ltd. or resolving to the same IP range, as these may indicate coordinated phishing campaigns. The elevated risk level persists due to the domain's prior activity and the lack of transparency in its registration details.