y85i[.]xyz

This domain is flagged for elevated risk due to brand impersonation, specifically targeting Bet365, a well-known online betting platform. The fraudulent site mimics legitimate login and account management pages to harvest user credentials, payment details, or install malicious payloads under the guise of a trusted service. Analysis indicates the domain y85i.xyz was registered on July 29, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 45.196.247.200, hosted in Hong Kong under AS140224 (Nebula Global LLC). The site was detected by 17 out of 95 security vendors on VirusTotal, with listings on two blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued to Default Company Ltd, a common indicator of low-effort or automated malicious infrastructure. The page title, welcome-BET365, further confirms the intent to deceive users into believing they are interacting with the legitimate Bet365 platform. Mitigation requires immediate blocking of the domain and its associated IP at network and endpoint levels. Security teams should monitor for credential theft attempts linked to this campaign, particularly targeting users who may have engaged with the fraudulent site. User awareness training should emphasize verifying domain authenticity before entering login or financial details, especially for high-value services like online betting platforms. Organizations should also review logs for connections to 45.196.247.200 or related infrastructure to identify potential compromises. If credentials were exposed, affected accounts must be secured through password resets and multi-factor authentication enforcement.