j134p[.]xyz

Analysis of j134p.xyz, created on 21 February 2026, shows that the domain is currently offline but was previously resolved to the IPv4 address 45.196.247.191, which is registered to an AS140224 network operated by Nebula Global LLC in Hong Kong. The site presented a page title of "welcome-BET365" and was identified as a crypto gambling impersonation of the Bet365 brand. An SSL certificate labeled R13 was observed, indicating that the domain employed TLS encryption despite its fraudulent purpose. Threat intelligence correlates the domain with a single AlienVault OTX pulse, and it appears on one external security blocklist.

Independent scanning on VirusTotal recorded 14 detections out of 93 security vendors, confirming that multiple engines flagged the domain as malicious. PhishDestroy has also listed j134p.xyz as blocked. The combined evidence—brand impersonation, crypto gambling claim, TLS usage, IP hosting in Hong Kong, and multi‑vendor detections—supports an elevated risk rating.

Uncertainties remain regarding the full scope of the hosting infrastructure, any additional command‑and‑control endpoints, and the specific phishing kit employed, as no further payload analysis is available. Defenders should immediately add 45.196.247.191 to network deny lists, enforce DNS filtering for the j134p.xyz FQDN, and monitor related ASN activity for new sub‑domains. Continuous review of emerging blocklist entries and OTX updates is advised to capture any future re‑hosting attempts.