x59f[.]xyz

Analysis of x59f.xyz indicates the domain is actively used for a brand‑impersonation campaign targeting Bet365. The site was registered on 14 August 2025 through Gname.com Pte. Ltd., and its authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. The domain resolves to the IP address 45.196.247.159, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. No TLS certificate was observed, implying the site is served over plain HTTP. The page title returned by the server is "welcome‑BET365", matching the declared brand target Bet365 and supporting the classification as a crypto‑gambling impersonation.

Threat‑intel feeds have recorded the domain on a single security blocklist and it is listed in sixteen AlienVault OTX pulses. VirusTotal scanned the domain and fourteen of ninety‑five scanning engines reported a detection, confirming malicious behavior. The domain is also blocked by the PhishDestroy service. These independent observations suggest the infrastructure is recognized by multiple defensive platforms. The current operational status is offline, which may reflect takedown actions or a temporary suspension.

However, the underlying infrastructure—registrar, hosting ASN, and name server configuration—remains visible and could be reused for future campaigns. Defenders should continue to monitor the IP 45.196.247.159 and the associated name servers for re‑registration activity. Adding the domain and its IP to internal block lists, as well as updating URL filtering rules for the Bet365 brand, will reduce exposure. Where possible, threat‑intel platforms should be queried for any resurgence of the domain or related indicators of compromise. Continuous verification of the registrar Gname.com Pte. Ltd. for suspicious registrations is also recommended.