m19r[.]xyz

Analysis of the domain m19r.xyz as of July 23 2026 shows a recent registration (21 February 2026) that immediately resolves to the IPv4 address 45.196.247.146. The host resides in Hong Kong and is announced by ASN AS140224, registered to Nebula Global LLC. TLS inspection reveals an SSL certificate labeled “R13”, and the only observed HTTP response contains the page title “welcome‑BET365”, confirming an explicit reference to the Bet365 brand. The threat profile is classified as a crypto‑ gambling impersonation of Bet365. The domain appears in one security blocklist and has been actively blocked by the PhishDestroy sinkhole.

AlienVault OTX lists the domain in a single pulse, and VirusTotal reports that 13 of 95 scanning engines flag the site as malicious. Current network probing indicates the service is offline, suggesting the infrastructure has been taken down or is temporarily inactive. Evidence does not include screenshots, login forms, or additional sub‑domains, leaving the exact payload and user‑interaction mechanics unknown.

Defenders should continue to deny DNS resolution for m19r.xyz, enforce outbound filtering to the associated IP address, and incorporate the domain and its hosting ASN into threat‑intel feeds. Monitoring for re‑registration or rapid changes in DNS records is advised, as actors frequently reuse compromised hosting assets. End‑user awareness campaigns should remind customers that Bet365 communications are never delivered from unrelated .xyz domains and that unsolicited crypto‑ gambling offers are indicative of fraud.