90811[.]xyz

This domain, 90811.xyz, poses a targeted brand impersonation threat against Bet365, a widely recognized online gambling platform. The site displays a page titled 'welcome-BET365,' designed to deceive users into believing they are accessing a legitimate Bet365 portal. Such impersonation typically aims to harvest login credentials, financial details, or install malicious software under the guise of a trusted brand. The elevated risk level is justified by the domain's active deployment in phishing campaigns, despite its current offline status, indicating prior malicious intent and potential for future reactivation. Analysis indicates that 90811.xyz was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusually forward-dated creation that may suggest automated or bulk registration practices. The domain resolves to the IP address 45.196.247.27, hosted under AS140224 (Nebula Global LLC) in Hong Kong. On VirusTotal, 17 out of 95 security vendors flagged this domain as malicious, reflecting moderate but consistent detection across multiple engines. Additionally, the domain appears on one security blocklist, further corroborating its association with phishing infrastructure. Notably, the absence of an SSL certificate increases the likelihood of interception or manipulation of user data. Users who accessed 90811.xyz should immediately cease all interaction and assume potential exposure of credentials or personal information. It is recommended to reset passwords for Bet365 and any other accounts where identical credentials may have been reused. Monitoring financial statements for unauthorized transactions is advised, particularly if payment details were entered. Security teams should update blocklists to include this domain and its associated IP address, 45.196.247.27, to prevent future access attempts. Given the domain's creation date anomaly, organizations should remain vigilant for similarly registered domains that may emerge as part of coordinated phishing campaigns.