90831[.]xyz

This domain presents an elevated risk profile as a brand impersonation infrastructure specifically targeting Bet365, with indicators consistent with credential theft operations. The observed page title 'welcome-BET365' demonstrates deliberate visual and textual mimicry intended to mislead users into believing the site is affiliated with the legitimate service. The absence of SSL encryption further increases interception risk for any submitted credentials, while hosting on offshore infrastructure suggests deliberate evasion of enforcement and takedown actions.

Technical telemetry provides strong corroborating evidence of malicious intent and operational deployment. VirusTotal 17/95 security vendors flag this domain, indicating broad cross-engine detection consensus. The domain was registered through Gname.com Pte. Ltd. and created on February 21, 2026. It resolves to IP 45.119.97.37 hosted under AS133861 SonderCloud Limited in the US region. The domain appears on 1 security blocklist and has been taken offline, which aligns with reactive enforcement following detection of active abuse patterns.

Given its classification as credential theft infrastructure, any interaction with this domain should be treated as potential account compromise. Users who entered credentials should immediately change passwords for affected accounts and any reused credentials across services. Session tokens should be revoked, and multi-factor authentication should be enabled where available. Additionally, endpoint scans are recommended to rule out malware persistence, and monitoring of financial or account activity is advised to detect unauthorized access attempts originating from harvested credentials.