j249f[.]xyz

This domain, j249f.xyz, was registered on December 24, 2025, through Gname.com Pte. Ltd. and is currently offline. Analysis indicates it was actively impersonating Bet365, a known gambling brand, as evidenced by the page title 'welcome-BET365' and classification under 'Crypto Gambling' scam type. The domain resolved to IP 45.196.247.160, hosted on AS140224 (Nebula Global LLC) in Hong Kong, an infrastructure frequently associated with fraudulent activity. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data.

Defenders should note that j249f.xyz appears on at least one security blocklist (PhishDestroy) and has been flagged by 14 of 93 security vendors on VirusTotal. AlienVault OTX records show the domain in three threat intelligence pulses, suggesting prior malicious activity. Nameservers (ns1.1111343.com, ns1.dnsbm.com, and others) are consistent with patterns observed in other phishing campaigns, though no specific phishing kit has been confirmed. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification.

While the domain is currently offline, defenders should monitor for reactivation or migration to new infrastructure. Historical DNS and IP associations should be reviewed for potential lateral movement within the same hosting provider or ASN. If Bet365-related phishing is a priority, this domain should be blocked at the network and endpoint levels, and any related IOCs (IP, nameservers) should be added to detection rules. Further analysis of AlienVault OTX pulses may reveal additional linked domains or IPs for proactive mitigation.