r36t[.]xyz

This domain, r36t.xyz, poses a direct threat as a brand impersonation phishing site designed to mimic Bet365, a well-known online betting platform. The site displays a page titled 'welcome-BET365,' attempting to deceive users into believing they are interacting with the legitimate Bet365 service. Such impersonation domains are commonly used to harvest login credentials, financial details, or install malware under the guise of trusted branding, putting users at significant risk of financial loss or identity theft.

Analysis indicates that r36t.xyz was registered on January 04, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 45.196.247.179, located in Hong Kong under AS140224 (Nebula Global LLC), an autonomous system with a history of hosting malicious infrastructure. As of the latest scan, 19 out of 95 security vendors on VirusTotal have flagged this domain as malicious, confirming its elevated risk status. The SSL certificate (R13) does not provide sufficient trust, as it is not issued by a widely recognized certificate authority, further indicating the domain's fraudulent nature.

If a user has visited r36t.xyz or interacted with its content, immediate action is required. First, disconnect the device from the internet to prevent potential data exfiltration. Run a full system scan using updated antivirus software to detect and remove any malware. Change passwords for all accounts accessed from the compromised device, particularly those associated with financial services or sensitive personal information. Monitor bank statements and credit reports for unauthorized transactions. Users should also report the incident to their organization's security team or a trusted cybersecurity professional for further analysis and remediation.