r36o[.]xyz

This domain, r36o.xyz, is flagged for brand impersonation targeting Bet365, a well-known gambling brand. The domain does not use a specific drainer kit but impersonates the brand to deceive users and potentially gather sensitive information.

Technical indicators for r36o.xyz include a VirusTotal detection score of 17/95, indicating that 17 out of 95 security vendors have flagged the domain as malicious. The domain is registered with a registrar that is not specified in the known intelligence. It resolves to the IP address 45.196.247.160, which is located in Hong Kong and is part of the AS140224 Nebula Global LLC network. The domain was created on February 21, 2026, and it has been added to 1 security blocklist. Additionally, the page title 'welcome-BET365' further suggests the intent to impersonate Bet365. The domain is currently offline, which may indicate a temporary takedown or ongoing mitigation efforts.

The current status of r36o.xyz is offline, which suggests that some response actions have been taken to disrupt the malicious activity. However, the domain remains a significant risk due to its elevated threat level and the specific targeting of Bet365. Users are advised to avoid interacting with this domain and to report any related suspicious activity to their security teams. The ongoing monitoring of the domain and associated IP addresses is recommended to ensure that it does not re-emerge with renewed threats.