195143[.]com

This domain, 195143.com, is identified as a brand impersonation threat specifically targeting Bet365, a well-known online gambling and sports betting platform. Analysis indicates the site was designed to deceive users into believing they were accessing legitimate Bet365 services, likely harvesting credentials or financial information through fraudulent login portals. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns commonly associated with such impersonation schemes. Infrastructure analysis reveals the following technical indicators: the domain was registered on January 12, 2022, through GoDaddy.com, LLC, and resolved to the IP address 203.168.128.221, hosted under AS135074 (DREAM CLOUD INNOVATION PTE. LTD.) in Japan. VirusTotal detection metrics show 20 out of 95 security vendors flagged the domain as malicious, while it appeared on a single security blocklist. The domain utilized a Let's Encrypt SSL certificate (R12), a common tactic to lend superficial legitimacy to phishing sites. No entries were found in Google Safe Browsing at the time of analysis. As of the latest assessment, 195143.com has been taken offline, likely in response to detection and reporting by security entities. However, the elevated risk persists due to the domain's historical activity and the potential for re-emergence under similar infrastructure. Users who may have interacted with the site are advised to reset credentials immediately, enable multi-factor authentication on all accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.