90420[.]xyz

This domain is flagged for elevated-risk brand impersonation targeting Bet365, a well-known online betting platform. The threat involves a fraudulent website designed to harvest user credentials by mimicking the legitimate Bet365 interface, as evidenced by the page title 'welcome-BET365.' Such impersonation campaigns typically aim to deceive users into entering sensitive login details, which are then exfiltrated for unauthorized access or financial fraud. Analysis indicates the domain 90420.xyz was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive domains. The domain resolves to the IP address 45.119.97.37, hosted under AS133861 (SonderCloud Limited), an autonomous system with a history of hosting malicious infrastructure. No SSL certificate is present, increasing the risk of unencrypted data transmission. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure analysis reveals the domain was taken offline following detection, though its prior activity remains a concern for potential victims. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and associated IP address across network security controls. Organizations should monitor for credential theft attempts originating from affected users and implement multi-factor authentication to mitigate unauthorized access. End-users are advised to verify domain authenticity before entering credentials, particularly for financial or betting platforms. Security teams should review logs for interactions with 90420.xyz or 45.119.97.37 and conduct awareness training to highlight the risks of brand impersonation attacks targeting online betting services.