a57a[.]xyz

The domain a57a.xyz was registered on 21 February 2026 and is currently taken offline. Analysis of public intelligence shows that the site presented a page titled “welcome‑BET365”, explicitly targeting the Bet365 brand and employing a crypto‑gambling lure. The SSL certificate is identified as type R12, and the domain resolves to the IPv4 address 45.196.247.146, which belongs to AS140224 (Nebula Global LLC) located in Hong Kong. VirusTotal scans have recorded 12 detections out of 93 security vendors, indicating that a notable fraction of AV engines consider the host malicious.

The domain appears on a single external blocklist and is listed as blocked by the PhishDestroy service. Additional reputation services assign extremely low scores: Gridinsoft rates the domain 0 out of 100, while Scamadviser assigns a trust score of 1 out of 100. AlienVault OTX references the domain in two separate threat‑intel pulses, reinforcing its association with known malicious campaigns. The observed attributes—brand impersonation of Bet365, crypto‑gambling context, low reputation scores, and multiple vendor detections—are consistent with a credential‑harvesting or financial‑fraud operation.

Uncertainty remains regarding the specific phishing kit or the exact payload delivered, as no page content beyond the title has been captured. Defenders should continue to block the resolved IP address and the domain on perimeter firewalls, update URL filtering feeds with the a57a.xyz indicator, and monitor for any re‑registration or resurrection of the host. Correlating the 12 vendor detections with internal logs may reveal attempted connections or credential submissions. Given the low trust scores and the presence on OTX pulses, adding the domain to internal threat‑intel repositories and sharing the indicator with upstream threat‑sharing communities is recommended.