p28d[.]top

This domain, p28d.top, is identified as a brand impersonation threat targeting Bet365, a well-known online betting platform. Analysis of the page title, 'welcome-BET365,' confirms the domain’s intent to deceive users by replicating the legitimate Bet365 interface. No evidence of a crypto drainer kit was observed, but the infrastructure is consistent with credential harvesting operations designed to capture login credentials and personal information from unsuspecting victims. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 154.39.104.132, hosted under AS18186 (Nebula Global LLC) in Hong Kong. The domain was registered on May 26, 2026, through NameMart Pte. Ltd., an uncommon registrar for legitimate betting services. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by ZeroSSL GmbH under the ZeroSSL RSA DV SSL CA 2 intermediate authority, a common choice for low-cost or disposable certificates used in phishing campaigns. As of the latest assessment, p28d.top has been taken offline, reducing immediate exposure to end-users. However, the domain’s registration remains active until 2026, posing a residual risk of reactivation. Organizations and individuals are advised to monitor for similar domains registered through NameMart Pte. Ltd. or resolving to the same IP range. Users who may have interacted with this domain should reset credentials for Bet365 and enable multi-factor authentication on all sensitive accounts. Network defenders should update blocklists to include the domain and associated IP address to prevent potential re-emergence of this threat.