p115r[.]xyz

This domain, p115r.xyz, is flagged as an elevated-risk brand impersonation threat specifically targeting Bet365, a well-known online gambling platform. The threat type involves deceptive replication of the legitimate Bet365 interface to harvest user credentials, payment details, or other sensitive information under false pretenses. Analysis indicates this is not a generic phishing attempt but a targeted campaign designed to exploit the trust associated with the Bet365 brand, potentially leading to financial loss or account compromise for unsuspecting users. Infrastructure analysis reveals multiple technical indicators corroborating the malicious nature of this domain. The domain was registered on January 8, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 45.196.247.189, located in Hong Kong under AS140224 (Nebula Global LLC), an autonomous system with a history of hosting fraudulent infrastructure. Detection metrics further substantiate the threat: the domain appears on one security blocklist (PhishDestroy) and is flagged by 17 out of 95 security vendors on VirusTotal. The SSL certificate, identified as R12, is a short-lived certificate type commonly abused in ephemeral phishing campaigns. The page title, 'welcome-BET365,' directly mimics the branding of the legitimate Bet365 platform, reinforcing the impersonation tactic. Mitigation steps for this specific threat type include immediate cessation of interaction with the domain and any associated links. Users who may have engaged with p115r.xyz should perform a full credential audit, prioritizing accounts tied to financial services or the Bet365 platform. Financial institutions and Bet365 should be notified of potential fraudulent activity stemming from this domain. Organizations are advised to block the domain and its resolving IP (45.196.247.189) at the network perimeter, and monitor for further indicators of compromise, such as unusual login attempts or unauthorized transactions. Given the domain's current offline status, continuous monitoring for reactivation or similar domains registered through the same infrastructure (e.g., Gname.com Pte. Ltd. or AS140224) is recommended to preempt future campaigns.