r31x[.]xyz

This domain, r31x.xyz, is identified as a brand-impersonation threat targeting Bet365, a widely recognized online gambling platform. Analysis indicates the domain was designed to deceive users into believing they are accessing a legitimate Bet365 portal, as evidenced by the page title 'welcome-BET365.' The intent is likely to harvest user credentials, payment details, or other sensitive information through fraudulent login or registration forms. Such impersonation campaigns are commonly associated with credential theft, financial fraud, and unauthorized account access, posing significant risks to both individual users and organizational security if credentials are reused across services.

Technical evidence underscores the malicious nature of r31x.xyz. The domain was registered on February 21, 2026, and resolves to the IP address 45.196.247.146, hosted under AS140224 (Nebula Global LLC) in Hong Kong. Detection metrics reveal that 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate, identified as 'R12,' does not mitigate the risk, as the domain has since been taken offline. The registrar details, while not explicitly provided, align with patterns observed in other transient phishing domains designed for short-term exploitation.

Users who visited r31x.xyz or interacted with its content should take immediate remedial actions. First, any credentials entered on the site must be considered compromised and reset across all platforms where identical or similar passwords were used. Second, affected users should monitor financial accounts and transaction histories for unauthorized activity, particularly if payment details were submitted. Third, devices used to access the domain should undergo a security scan to detect potential malware or browser-based exploits. Organizations should also review logs for connections to 45.196.247.146 or r31x.xyz to identify compromised endpoints. Proactive measures, such as enabling multi-factor authentication and educating users on recognizing brand-impersonation tactics, are recommended to mitigate future risks.