loca-betresmi[.]xyz

Analysis of loca-betresmi.xyz indicates a high-risk phishing domain targeting online betting users. The domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. It resolves to IP address 104.21.6.99, hosted on Cloudflare infrastructure in Canada, with nameservers kira.ns.cloudflare.com and luke.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist and is flagged by three of 92 security vendors on VirusTotal, though the specific detection labels are not disclosed. AlienVault OTX lists it in one threat intelligence pulse, suggesting prior malicious activity. The HTTP status returns a 403 Forbidden response, which may indicate protective measures by the hosting provider or an attempt to conceal the site's content. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, though it does not confirm the final destination's content. No brand-specific details or phishing kit signatures are available in the current intelligence. Defenders should treat this domain as active and malicious, particularly in environments where gambling or betting-related traffic is monitored. Blocking the domain at DNS or proxy level is recommended, along with monitoring for connections to 104.21.6.99 or related Cloudflare IPs. Further investigation into associated threat actor infrastructure may be warranted if internal logs show user interaction with this domain.