bet365e[.]sbs

This domain, bet365e.sbs, poses a credential harvesting threat targeting users of the Bet365 online betting platform. Analysis indicates the site was designed to mimic the legitimate Bet365 interface, tricking visitors into entering sensitive account details such as usernames, passwords, and financial information. The page title explicitly displays 'BET365,' reinforcing the deception by replicating the brand's visual identity. Such impersonation tactics are commonly employed in phishing campaigns to exploit user trust and gain unauthorized access to accounts. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. It was registered on September 28, 2025, through Domain International Services Limited, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 103.194.105.181, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, an autonomous system with a history of hosting fraudulent sites. Detection metrics further substantiate the threat: 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it also appears on one security blocklist. Notably, the absence of an SSL certificate is a critical red flag, as legitimate financial and betting platforms universally enforce encrypted connections. Users who visited bet365e.sbs should take immediate remedial actions to mitigate potential risks. First, any credentials entered on the site must be considered compromised and changed immediately on the legitimate Bet365 platform. Affected individuals should monitor their accounts for unauthorized transactions or suspicious activity and enable multi-factor authentication if not already active. Additionally, devices used to access the phishing site should undergo a thorough security scan to detect potential malware or keyloggers. Reporting the incident to the legitimate service provider and relevant cybersecurity authorities can aid in broader threat mitigation efforts. Vigilance against similar phishing attempts should be maintained by verifying domain authenticity and scrutinizing URLs before entering sensitive information.