g32z[.]xyz

Analysis of the domain g32z.xyz indicates a confirmed brand impersonation campaign targeting Bet365, classified as a crypto-gambling scam. The domain was registered on December 20, 2025, through Gname.com Pte. Ltd., with nameservers ns1.1111343.com, ns2.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, ns3.1111343.com, and ns4.dnsbm.com. Infrastructure analysis reveals hosting on IP 45.196.247.147, geolocated in Hong Kong under AS140224 (Nebula Global LLC). No SSL certificate was detected, increasing susceptibility to interception. The page title, 'welcome-BET365,' directly references the targeted brand, aligning with the scam type identified in threat intelligence sources.

Detection metrics show the domain has been flagged by 12 of 93 security vendors on VirusTotal, appears on one security blocklist, and is present in two AlienVault OTX threat intelligence pulses. Trust scores from Scamadviser (1/100) and Gridinsoft (0/100) further corroborate malicious classification. The domain is currently offline, with no active HTTP response observed. PhishDestroy has blocked the domain, though the specific detection methodology is not detailed in available intelligence.

Defenders should treat this domain as high-risk for Bet365 users, particularly those engaged in crypto-gambling activities. The absence of SSL and use of a high-risk hosting provider suggest infrastructure commonly associated with fraudulent operations. While the exact content of the site remains unanalyzed, the combination of brand impersonation, low trust scores, and multi-vendor detections provides sufficient evidence for blacklisting. Monitoring for re-registration or IP reuse under alternative domains is recommended, as the registrar and hosting provider have been linked to prior malicious activity.