u89t[.]xyz

This domain, u89t.xyz, is flagged for brand impersonation targeting Bet365, a major online betting platform. The site presents a fraudulent interface labeled 'welcome-BET365' to deceive users into entering account credentials, payment details, or other sensitive information under the guise of legitimate Bet365 services. The threat is classified as credential theft and brand abuse, with potential secondary risks including financial fraud or account takeover if victims disclose login or payment data. Analysis indicates the domain was registered on February 21, 2026, through an undisclosed registrar. It resolves to the IP address 45.196.247.26, hosted on AS140224 (Nebula Global LLC) in Hong Kong. Security vendors on VirusTotal flagged the domain at a rate of 18/95, while infrastructure analysis reveals it appears on one security blocklist. The SSL certificate is classified as R13, and the domain is currently offline, though this status may change. The page title, 'welcome-BET365,' directly references the targeted brand, reinforcing its impersonation tactics. Users who visited u89t.xyz should immediately revoke any entered credentials, particularly Bet365 login details or financial information. Monitor associated accounts for unauthorized transactions or activity, and enable multi-factor authentication where available. If payment details were disclosed, contact financial institutions to flag potential fraud. Security teams should update blocklists to include this domain and its resolving IP address, 45.196.247.26, to prevent further exposure. Given the elevated risk level, organizations should treat this domain as a confirmed credential theft vector and prioritize user awareness regarding brand impersonation threats.