p71f[.]xyz

The domain p71f.xyz was registered on June 24, 2025 through Gname.com Pte. Ltd. and currently resolves to the IP address 45.196.247.189, which is assigned to AS140224 Nebula Global LLC and geolocated to Hong Kong. No SSL certificate is presented for the site, indicating that communications are unencrypted. The authoritative nameservers listed are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4, and ns1.dnsbm.com, ns2.dnsbm.com, a configuration that is common among malicious infrastructure. The page title returned by the server is "welcome-BET365," directly referencing the targeted brand Bet365 and confirming a brand‑impersonation intent.

The domain is listed on one external security blocklist and has been actively blocked by PhishDestroy, demonstrating that at least one defensive organization has taken remediation steps. Additionally, AlienVault OTX records show inclusion in fifteen threat‑intelligence pulses, reinforcing the notion of ongoing monitoring by the threat‑intel community. VirusTotal scans report fourteen detections out of ninety‑five security vendors, indicating a consensus among multiple scanners that the domain is malicious. The site’s current HTTP status is offline, which may be temporary or part of takedown efforts.

While the exact page content has not been captured, the combination of brand‑targeted page title, absence of TLS, malicious hosting, and multiple independent detections provides sufficient evidence to classify the domain as a high‑risk brand‑impersonation vector. Defenders should add p71f.xyz to URL filtering and DNS blocklists, monitor the associated IP range for related activity, and consider sinkholing the domain to disrupt any remaining infrastructure. Continuous watch of the registrar Gname.com for further registrations linked to this pattern is also advised.