j209g[.]xyz

Analysis of the domain j209g.xyz indicates a deliberate brand‑impersonation campaign targeting Bet365. The site was registered through Gname.com Pte. Ltd. on August 22 2025 and uses the authoritative name servers ns1.1111343.com through ns4.1111343.com. The HTTP response presents the page title “welcome‑BET365”, matching the declared brand target. No TLS certificate is present, confirming that the site operated over plain HTTP before being taken offline. DNS resolution points to IP 23.248.207.196, an address assigned to AS138415 Yancy Limited in Hong Kong.

The same IP has been observed in other cryptocurrency‑gambling abuse cases, reinforcing the attribution to a crypto‑gambling scam infrastructure. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain, suggesting a moderate level of detection across the ecosystem. AlienVault OTX records the domain in sixteen distinct threat‑intel pulses, and it appears on a single external blocklist that has been incorporated into the PhishDestroy mitigation service, which has already blocked the domain. The combined evidence places the operation in the “crypto gambling” category, where actors lure victims with promises of cryptocurrency betting under the guise of a well‑known sportsbook. Current status is offline, which limits immediate interaction but does not eliminate residual risk.

Defensive teams should continue to enforce DNS‑level deny‑list rules for 23.248.207.196 and its associated ASN, and ensure that any residual HTTP traffic to j209g.xyz is dropped. Monitoring for re‑registration of the domain or similar look‑alike domains using the same registrar or name‑server pattern is advised. Incorporating the domain into internal blocklists and updating web‑gateway signatures will help prevent future exposure. Continuous correlation with OTX pulse updates and VirusTotal re‑scans is recommended to capture any resurgence of the campaign.