90437[.]xyz

This domain, 90437.xyz, is identified as a brand-impersonation threat targeting Bet365, a well-known online betting platform. The site was designed to mimic the legitimate Bet365 portal, as evidenced by its page title 'welcome-BET365,' and is classified as an elevated-risk threat due to its potential for credential harvesting and financial fraud. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used in phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate betting services. It resolved to the IP address 45.196.247.27, hosted in Hong Kong under AS140224 (Nebula Global LLC), a network frequently associated with malicious activity. Security vendors flagged the domain in 18 of 95 VirusTotal scans, and it appears on at least one security blocklist, specifically PhishDestroy. Notably, the domain lacked an SSL certificate, a critical red flag for any site handling user credentials or financial transactions. Current status confirms 90437.xyz is offline, though the infrastructure remains a potential risk for future abuse. Organizations and users are advised to block the domain and its associated IP (45.196.247.27) at the network level. Security teams should monitor for similar domains registered through Gname.com or hosted on Nebula Global LLC infrastructure, particularly those impersonating betting platforms. End-users should verify the legitimacy of any Bet365-related communications by cross-referencing official domains and enabling multi-factor authentication on accounts to mitigate credential theft risks.