e118l[.]xyz

This domain, e118l.xyz, poses a significant credential harvesting and financial fraud threat by impersonating the legitimate Bet365 betting platform. The site presents itself as an official Bet365 portal, using identical branding, logos, and page titles such as 'welcome-BET365' to deceive users into entering sensitive login credentials, payment details, or personal information. Such impersonation domains are commonly used in phishing campaigns to facilitate unauthorized account access, financial theft, or identity fraud, particularly targeting users of online betting and gambling services.

Analysis indicates this domain was registered on December 6, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 45.196.247.146, hosted on AS140224 (Nebula Global LLC) in Hong Kong, an infrastructure provider often linked to malicious activity. Security vendors have flagged this domain extensively, with 15 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on one security blocklist and was previously blocked by PhishDestroy, further confirming its fraudulent nature. The SSL certificate (R13) does not provide sufficient trust, as it is a low-assurance certificate commonly used by threat actors to mimic legitimacy.

If you have visited e118l.xyz or entered any information on this site, immediate action is required to mitigate potential risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were entered, change passwords for Bet365 and any other accounts using the same login details, enabling multi-factor authentication where possible. Monitor financial statements and credit reports for unauthorized transactions or signs of identity theft. Report the incident to the legitimate Bet365 security team and consider filing a complaint with relevant cybersecurity authorities or consumer protection agencies. Users should also update their security software and run a full system scan to detect any potential malware or backdoors installed during the visit.