h21a[.]top

This domain, h21a.top, is actively impersonating the Bet365 online betting platform, presenting a high-risk threat of credential theft and financial fraud. The site displays a page titled 'welcome-BET365,' designed to deceive users into entering login credentials or financial details under the false pretense of accessing legitimate betting services. Analysis indicates the domain is specifically crafted to exploit trust in the Bet365 brand, potentially leading to unauthorized account access or monetary loss for victims.

Technical evidence confirms the malicious nature of h21a.top. The domain is flagged by 14 out of 95 security vendors on VirusTotal, indicating widespread detection as a phishing threat. Registered through NameMart Pte. Ltd. on May 26, 2026, the domain resolves to the IP address 154.39.104.132, hosted under AS18186 Nebula Global LLC in Hong Kong. It appears on one security blocklist and uses a Let's Encrypt SSL certificate (R13), which, while providing encryption, does not validate the legitimacy of the site. The creation date suggests recent registration, a common tactic in phishing campaigns to evade prior detection.

Users who have visited h21a.top or entered credentials on the site should immediately take corrective action. Change passwords for any accounts accessed via the domain, particularly Bet365 or other financial services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked financial accounts for suspicious transactions and report any anomalies to the respective institution. If personal or payment information was submitted, consider placing a fraud alert on credit files. Network administrators should block the domain and its resolving IP (154.39.104.132) at the firewall or DNS level to prevent further exposure.