b206p[.]xyz

This domain, b206p.xyz, is flagged as a brand impersonation phishing site targeting Bet365, a well-known online gambling platform. Analysis indicates the site was designed to mimic the legitimate Bet365 interface, as evidenced by the page title 'welcome-BET365,' with the intent to harvest user credentials or financial information. No crypto drainer kit signatures were observed in available telemetry, but the infrastructure aligns with credential theft campaigns targeting high-value brands in the gaming and betting sectors.

Infrastructure analysis reveals the domain was registered on July 25, 2025, through Gname.com Pte. Ltd. and resolves to the IP address 45.196.247.162, hosted under AS140224 (Nebula Global LLC) in Hong Kong. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious. The site lacks an SSL certificate, a common red flag for phishing infrastructure. It appears on two security blocklists, including PhishDestroy and PhishingDB, and was not detected by Google Safe Browsing at the time of this report.

The domain has since been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, residual risk remains, as threat actors may re-deploy the infrastructure under a new domain or IP address. Users who interacted with the site should assume credential exposure and initiate password resets for associated accounts. Organizations are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP range, as these may indicate follow-on campaigns.