y119m[.]xyz

This domain represents a credential harvesting page designed to impersonate Bet365. It is structured to deceive users into believing they are accessing a legitimate betting service login interface. The page title welcome-BET365 indicates an attempt to mimic brand authentication flows and capture sensitive account credentials such as usernames, passwords, and potentially payment-related data. The infrastructure indicates a transient phishing setup intended for short-lived campaigns, especially given its current offline status, suggesting cleanup or takedown after detection.

Analysis of telemetry shows multiple high-confidence indicators. VirusTotal reports 18/95 security vendors flagging the domain as malicious. The domain was created on February 21, 2026 and is registered through Gname.com Pte. Ltd. Infrastructure mapping resolves it to IP 45.196.247.27 located in Hong Kong under AS140224 Nebula Global LLC. No SSL certificate is present, increasing interception risk. The domain is also listed on 1 security blocklist and has already been marked as taken offline by mitigation systems.

Users who visited the domain should assume credentials may be compromised. Immediate password reset is recommended for any reused Bet365 or similar accounts, along with enabling multi-factor authentication where available. Systems should be scanned for malware or unwanted browser extensions, as phishing pages may redirect to payload delivery chains. Clearing browser data and revoking active sessions on related services is advised. Security monitoring for unusual login activity should be maintained for at least several weeks following exposure.