b119v[.]xyz

Analysis dated July 23, 2026 flags the domain b119v.xyz as an elevated‑risk brand‑impersonation site targeting Bet365. The domain was registered on June 12, 2025 through Gname.com Pte. Ltd. and currently resolves to the IP address 45.196.247.159, which is hosted in Hong Kong under ASN 140224 (Nebula Global LLC). The hosting infrastructure is exposed through six authoritative name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4.) and presents no TLS certificate, indicating that any data transmitted would be unencrypted. Public reputation services assign the domain a near‑zero trust rating: Gridinsoft scores it 0/100, Scamadviser 1/100, and it appears on a single security blocklist.

VirusTotal scans have returned 13 positive detections out of 95 submitted engines, and the domain is listed in 16 AlienVault OTX pulses, confirming its repeated use in malicious campaigns. PhishDestroy has already taken the site offline, and the current status is reported as offline. The page title observed during the brief crawl is “welcome‑BET365”, and the campaign is classified as a crypto‑gambling scam that masquerades as the legitimate Bet365 betting platform. No additional content, login forms, or redirect behavior have been captured, so the exact payload and victim interaction flow remain uncertain.

Defenders should block the domain and its resolved IP at perimeter firewalls and DNS filtering solutions, add the associated name servers to threat‑intel feeds, and monitor for any future registrations that reuse the same registrar or hosting ASN. Continuous re‑scanning on multi‑engine services such as VirusTotal is recommended to capture any evolution of the payload. Incident response teams should also alert users of Bet365 to the impersonation attempt and advise against entering credentials on any site lacking a valid HTTPS certificate.