b220u[.]xyz

Analysis of the domain b220u.xyz indicates it was actively used in a brand-impersonation phishing campaign targeting Bet365, a recognized gambling platform. The domain was registered on October 2, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolved to the IP address 45.196.247.206, hosted on AS140224 (Nebula Global LLC) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted credential transmission if users engaged with the site. The page title, 'welcome-BET365,' directly references the targeted brand, and the scam type is classified as crypto gambling, suggesting the site was designed to deceive users into depositing cryptocurrency under fraudulent gambling pretexts.

Detection data from July 23, 2026, shows the domain was flagged by 16 of 95 security vendors on VirusTotal and appeared in 16 threat intelligence pulses on AlienVault OTX. It was also blocked by PhishDestroy and listed on at least one security blocklist. Trust scores from Gridinsoft and Scamadviser both rated the domain at 0/100 and 1/100, respectively, further indicating malicious intent. Nameserver records point to ns1.1111343.com, ns2.1111343.com, ns1.dnsbm.com, and ns2.dnsbm.com, infrastructure commonly reused in phishing operations. As of the report date, the domain has been taken offline, though defenders should remain cautious of related infrastructure.

The absence of SSL and the use of a hosting provider with a history of abuse are strong indicators of malicious activity. Defenders are advised to block the domain and associated IP at the network level, monitor for reuse of the nameserver infrastructure, and alert users to the crypto-gambling scam vector. While the domain is offline, historical logs should be reviewed for interactions with 45.196.247.206, and any linked accounts or transactions should be flagged for fraud investigation.