h70n[.]xyz

Analysis indicates that the domain h70n.xyz was registered on 26 October 2025 through Gname.com Pte. Ltd. The authoritative name servers ns1-ns4.1111343.com resolve the domain to the IPv4 address 45.196.247.159, which is announced by AS140224 belonging to Nebula Global LLC and geolocated to Hong Kong. No TLS certificate is presented, so connections are unencrypted. The site title returned from the HTTP response is "welcome-BET365", matching the declared brand target Bet365 and confirming a brand-impersonation campaign. VirusTotal reports that 13 of 95 scanned scanners flagged the host, and the domain appears on a single public blocklist. PhishDestroy also lists the address as blocked.

AlienVault OTX has associated the domain with fourteen distinct threat-intelligence pulses, reinforcing its classification as a malicious resource. The campaign is labeled as a crypto-gambling scam, suggesting that the fraudulent page likely attempts to lure victims into depositing cryptocurrency under the guise of Bet365 services. The domain is currently offline, which may indicate takedown or temporary cessation of activity. Uncertainty remains regarding the exact payload delivered to visitors, as no SSL handshake or page content beyond the title has been captured. The absence of a certificate also limits the ability to perform certificate-pinning checks.

Defenders should continue to monitor the IP address 45.196.247.159 for any re-use, enforce blocklist updates that include h70n.xyz, and consider adding the associated name servers to sinkhole configurations. Network-level filters that inspect HTTP host headers for "h70n.xyz" or the "welcome-BET365" title can help intercept residual traffic. Because the registrar is a public service, future domains registered by the same registrar should be scrutinized for similar naming patterns.