90561[.]xyz

This domain, 90561.xyz, is identified as a phishing infrastructure component specifically designed to impersonate Bet365, a well-known online gambling and sports betting platform. The site employs brand impersonation tactics, presenting itself as the legitimate Bet365 service to deceive users into disclosing sensitive credentials, financial information, or personal data. The page title, 'welcome-BET365,' directly mimics the branding of the legitimate site, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking betting or account management services.

Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It currently resolves to the IP address 45.119.97.37, hosted under AS133861 (SonderCloud Limited), an autonomous system linked to other phishing and fraudulent activities. No SSL certificate is present, leaving data transmissions unencrypted and vulnerable to interception. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious, while it appears on one additional security blocklist. The domain has since been taken offline, though its prior operational status poses residual risks to users who may have interacted with it.

Users who visited 90561.xyz or entered credentials on the site should take immediate remedial action. All exposed passwords must be changed across any accounts where the same credentials were reused, particularly for financial or email services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial statements and transaction histories for signs of fraudulent activity, and report any suspicious transactions to the relevant financial institution. If personal or payment details were submitted, consider placing a fraud alert or credit freeze with major credit bureaus. Organizations should update internal blocklists to prevent future access to this domain and related infrastructure.