w39m[.]xyz

This domain, w39m.xyz, operates as a fraudulent imitation of the legitimate Bet365 online betting platform. The site presents a fake login interface under the page title 'welcome-BET365,' designed to deceive users into entering their account credentials. Analysis indicates the primary threat is credential harvesting, where attackers collect usernames and passwords to gain unauthorized access to victims' legitimate Bet365 accounts, potentially leading to financial theft or identity fraud. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered on November 20, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with phishing operations. Security vendors have flagged the domain, with 18 out of 95 engines on VirusTotal detecting it as malicious. The site appears on two security blocklists and is currently offline, though this status may change. The domain resolves to IP address 45.196.247.168, hosted in Hong Kong under AS140224 Nebula Global LLC, an autonomous system known for hosting phishing infrastructure. Notably, the site lacks an SSL certificate, further indicating its fraudulent nature. Users who visited w39m.xyz should take immediate action to mitigate risks. First, change the password for any Bet365 account if credentials were entered on this site. Enable multi-factor authentication on the legitimate platform to add an extra security layer. Monitor the account for unauthorized transactions or suspicious activity, and report any anomalies to the official Bet365 support team. Additionally, scan the device used to access the site with updated security software to detect potential malware infections. If financial information was entered, contact the relevant financial institution to secure accounts and monitor for fraudulent charges. Users should also report the domain to their local cybersecurity authorities or anti-phishing organizations to aid in takedown efforts.