1xbet-app-so[.]com

This domain, 1xbet-app-so.com, is flagged as a generic phishing threat designed to impersonate the legitimate 1xBet platform, a well-known sports betting and online gambling service. Analysis indicates the domain was likely created to distribute fraudulent mobile or desktop applications, tricking users into installing malicious software under the guise of official 1xBet software. The campaign appears to target users seeking quick access to betting services, exploiting brand recognition to facilitate credential theft, financial fraud, or device compromise. No specific drainer kit or payload has been conclusively linked to this domain at this time, though the infrastructure aligns with common phishing distribution patterns observed in similar campaigns. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.21.93.29, a Cloudflare proxy endpoint commonly used to obfuscate the true hosting origin. Detection metrics indicate limited but targeted awareness: the domain is flagged by 2 out of 95 security vendors on VirusTotal, appears on a single security blocklist, and is referenced in one threat intelligence pulse on a public threat exchange platform. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Notably, the domain creation date is anomalous, set in the future (2026), which may indicate an attempt to evade reputation-based filtering or suggest a typo in available records. As of the latest assessment, 1xbet-app-so.com has been taken offline, likely following detection and reporting by security systems. The domain is currently blocked by at least one anti-phishing service, reducing immediate exposure risk. However, the underlying infrastructure remains a concern; the use of a bulletproof registrar and proxy services suggests the operators may rapidly redeploy similar domains. Users who interacted with the domain prior to takedown may still be at risk of follow-on attacks, including credential replay or malware persistence. Organizations and individuals are advised to monitor for unauthorized access attempts, revoke any credentials potentially exposed through this campaign, and implement domain-based blocking for related patterns. Continuous vigilance is recommended, as threat actors behind such campaigns often rotate domains and IPs to sustain operations.