90443[.]xyz

This domain, 90443.xyz, represents a targeted brand impersonation threat designed to deceive users of the Bet365 platform. Analysis indicates the infrastructure was specifically engineered to mimic the legitimate Bet365 interface, as evidenced by the page title 'welcome-BET365' and the domain's registration details. The intent appears to be credential harvesting or unauthorized account access, leveraging the trust associated with the Bet365 brand to exploit victims.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 45.196.247.27, hosted on AS140224 (Nebula Global LLC) in Hong Kong, a network frequently associated with fraudulent operations. Registered through Gname.com Pte. Ltd. on February 21, 2026, the domain lacks an SSL certificate, further reducing its legitimacy. Security vendors have flagged this domain in 18 out of 95 engines on VirusTotal, while one security blocklist (PhishDestroy) has already classified it as malicious. The creation date, set in the future (2026), suggests an attempt to evade detection by appearing as a newly registered domain.

Users who visited 90443.xyz should take immediate action to mitigate potential compromise. Any credentials entered on this domain must be considered exposed and should be reset immediately on the legitimate Bet365 platform. Monitor financial accounts and betting activity for unauthorized transactions, as stolen credentials may be used for fraudulent wagers or fund transfers. If payment details were submitted, contact financial institutions to flag potential fraud. Additionally, scan local devices for malware, as some phishing pages deploy malicious scripts to harvest additional data. Report the incident to relevant fraud reporting channels to assist in broader mitigation efforts.