bettabm[.]com

On July 22, 2026, bettabm.com was identified as a credential phishing site that impersonates Google. The domain was created on February 21, 2026, and the only observed page title is "Wattwealth," which does not contain the brand name but is linked to the impersonation tag in the intelligence. At the time of analysis the site was offline, returning no HTTP content. DNS resolution points to IP address 172.67.144.18, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States.

The TLS certificate presented on the domain is issued by GTS CA 1P5, a standard Cloudflare‑issued certificate, indicating normal CDN encryption but providing no further malicious clues. VirusTotal reported a single positive detection out of 93 security vendors, confirming that at least one scanner flagged the domain as malicious. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy service. Additionally, Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent.

No additional technical artefacts such as payload samples, redirection chains, or credential capture URLs have been released, so the exact phishing workflow remains uncertain. Defenders should continue to block bettabm.com at DNS, proxy, and web‑filter layers, and monitor outbound traffic to the associated Cloudflare IP address. Because the infrastructure relies on a shared CDN, sinkholing the IP is unlikely to be effective; domain‑level controls remain the preferred mitigation. Security teams are advised to update Google‑related phishing detection signatures to include the "Wattwealth" page title as a potential indicator of compromise and to schedule periodic re‑scans in case the domain resurfaces under a new host or subdomain.