b224h[.]xyz

This domain is flagged as an elevated-risk credential harvesting site specializing in brand impersonation of Bet365, a prominent online gambling platform. Analysis indicates the infrastructure was designed to deceive users into submitting account credentials through a fraudulent interface labeled 'welcome-BET365', a direct mimicry of the legitimate service’s branding and user experience flow. Infrastructure analysis reveals the domain b224h.xyz was registered on October 20, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 45.196.247.159, geolocated in Hong Kong under AS140224 (Nebula Global LLC), an autonomous system with historical ties to malicious hosting. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist (PhishDestroy). The SSL certificate, identified as R13, lacks extended validation, further reducing trust indicators. Despite its current offline status, the domain’s recent creation date and targeted impersonation tactics elevate its residual risk. Mitigation against this threat type requires a multi-layered approach. Organizations should implement DNS-based blocking for the domain and its resolved IP (45.196.247.159) across all network security controls. End-users should be educated on recognizing brand impersonation tactics, particularly the use of lookalike domains and urgent login prompts. Security teams are advised to monitor for residual indicators, including the domain’s registration pattern (Gname.com Pte. Ltd.) and hosting infrastructure (AS140224), to preemptively block emerging variants. Credential monitoring and multi-factor authentication enforcement are critical to mitigate potential account takeovers stemming from this campaign.