Domain security and threat intelligence

65443[.]xyz

“welcome-BET365”

Threat verdict Critical 88/100 evidence score

Availability Content unavailable Content was unavailable in the latest observation

Risk signals

VirusTotal detections: 12/91 URLQuery threat systems: 8 alerts Brand impersonation: Gmail

Aug 1, 2026 Gmail 1 Report Sent

Evidence Summary

CRITICAL

The domain 65443.xyz was registered through Gname.com Pte. Ltd. on March 21, 2026. DNS resolution points to the IPv4 address 103.244.148.113 and the authoritative nameservers are a.share-dns.com, a5.share-dns.com, b.share-dns.net, and b5.share-dns.net. VirusTotal analysis indicates that 12 of 91 security vendors have flagged the domain as malicious.

The domain appears on two public blocklists and is actively blocked by the PhishDestroy and OpenPhish feeds. The threat classification is generic phishing and the domain remains listed as active. No public information on page title, SSL/TLS certificate details, HTTP response status, Safe Browsing verdict, or Open Threat Exchange (OTX) references is currently available, leaving the exact phishing payload and targeted brand unknown.

Defenders should incorporate 65443.xyz into DNS sinkhole or blocklist configurations, deny any outbound traffic to 103.244.148.113, and ensure email gateways block messages containing this domain. Continuous monitoring for additional indicators, such as new blocklist listings or vendor detections, is recommended to capture any evolution of the campaign.

Submitted Evidence Snapshot

Sent: 2026-08-01 18:04:34 UTC
Ledger records: 1
Case ID: PD-20260801-691180
PDF artifact: PDF evidence

Full evidence text

Registrar: Gname.com Pte. Ltd. (Singapore)
Policy Violations: Illegal Activities section forbids phishing, fraud, fake sites, malware distribution; registrar investigates and may suspend or delete domain
Applicable Laws: Computer Misuse Act 1993 §§3+, Penal Code §§415–420 (cheating), Online Criminal Harms Act (OCHA)

VirusTotal

12 det.

URLQuery

8 threat alerts

TLS Certificate

Let's Encrypt

Age

5 mo

Observed status

Content unavailable HTTP 502

DestroyList

Listed

Reports Sent

Data Coverage

VirusTotal 12 / 91 URLQuery 8 threat-system alerts PhishStats not checked OTX no community references CF Radar scan completed URLScan capture stored report URLScan verdict verdict unavailable DNS blocks not checked TLS valid certificate, 43d WHOIS 5 mo old Screenshot 4 captures · 3 sources Redirect chain not probed

Network Security Intelligence

Threat Detection Systems 8 alerts

Detection System	Indicator	Verdict	Alert
DNS4EU	`19546.xyz`	malicious	Sinkholed
DNS4EU	`img.esportsdata.cc`	malicious	Sinkholed
DNS4EU	`ssl.hw301.xyz`	malicious	Sinkholed
Cloudflare DNS	`65443.xyz`	malicious	Sinkholed
CIRA Canadian Shield DNS	`65443.xyz`	malicious	Sinkholed
DNS4EU	`65443.xyz`	malicious	Sinkholed
OpenDNS	`65443.xyz`	phishing	Phishing Block
DigiCert UltraDNS	`65443.xyz`	malicious	Sinkholed

Threat Response Pipeline

Discovery

Checks

Reports

Availability

12/12

Blocklist coverage

10 monitored external feeds · stored snapshot Aug 11, 2026

PhishDestroy Source dataset

10 monitored external feeds No match

MetaMask No match ScamSniffer No match Polkadot No match CryptoFirewall No match OpenPhish No match SEAL No match Enkrypt No match Phishunt No match Codeesura No match DiscordPhishing No match

Detection timeline

First recorded
First stored value: Reachable

2026-08-01 20:01:26 UTC
Domain status
Reachable → Unreachable

2026-08-06 01:06:44 UTC

Stored Capture

Screenshot of 65443.xyz — **URLScan capture 1**2026-08-01 18:17 UTC 2 / 4

View Full Size Download

Page Title

welcome-BET365

Impersonates

Gmail

TLS Certificate

Valid transport encryption · Issued by Let's Encrypt · valid for 43 days

Domain Intelligence

Domain

Server / ASN Nginx · AS18186 NEBULA-GLOBAL - Nebula Global LLC, US

IP Reputation IP abuse confidence 0/100 0 reports checked Aug 1, 2026

Registrar Gname

(PH)

Abuse contactcomplaint@gname.com

ICANN RegistryOfficial ICANN accredited-registrars →

WHOIS LookupICANN RDAP for 65443.xyz →

IP Address 103.244.148.114

Geo

Tung Chung, HK

NetworkAS18186 · AS135357 HONG KONG KOWLOON TELECOMMUNICATIONS CO.,LIMITED

Reverse IPviewdns.info → rapiddns.io →

RegistrationCreated Mar 21, 2026 (143d) — Expires Mar 21, 2027

HTTP Status502 Error

Time to First Unavailability 4 days

What we count Elapsed time from the first stored abuse report to the first observation that the content was unavailable. This does not establish the cause.

What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.

Technical detailsDNS, TLS names and timestamps

First DetectedAug 1, 2026

DOM Analysisanalyzed Aug 1, 2026DOM analysis score 88/1001 brand signal

Submitted URLhttp://65443.xyz/

Nameserversa.share-dns.coma5.share-dns.comb.share-dns.netb5.share-dns.net

TLS fingerprint

TLS observationvalid from Jun 16, 2026scanned Aug 1, 2026

TLS subject alternative names65221.xyz65254.xyz65259.xyz65263.xyz65275.xyz65278.xyz65282.xyz65284.xyz65286.xyz65287.xyz65290.xyz65291.xyz65368.xyz65373.xyz65375.xyz+83

ICANN OVERSIGHT

Accreditation and RAA context

Registrar accreditation and DNS abuse obligations

For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.

Accreditation is a contract, not a safety certification.

RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.

Accreditation is a contract, not a safety seal. Verify ICANN fees Read RAA §3.18 PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight

Accountability draft Nothing is sent automatically.

Technologies

5 high-confidence technologies identified

Vue.js Nginx HSTS Cloudflare HTTP/3

Cloudflare Radar

Report This Domain Submit evidence & help protect others

VirusTotal Analysis

12 / 91 security vendors flagged this domain

View on VT

Last analyzed 2026-08-01 20:03:05 UTC

alphaMountain.ai

CRDF

ESET

Forcepoint ThreatSeeker

Fortinet

G-Data

Gridinsoft

LevelBlue

OpenPhish

SOCRadar

Sophos

Webroot

Site Performance Analysis

Google PageSpeed Insights — mobile performance audit of 65443.xyz · checked Aug 1, 2026

Poor

Performance

FCP

13.11s

First Contentful Paint

LCP

31.49s

Largest Contentful Paint

CLS

0.144

Cumulative Layout Shift

TBT

328ms

Total Blocking Time

20.43s

Speed Index

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

FBI IC3

Report internet-enabled crime in the United States

Federal tips line1-800-CALL-FBI

Europol

Find the official reporting channel for your EU country

National police directory

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Contact centre0300 123 2040

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

External tools

ScamAdviserScamAdviser Trust score 80/100Status: Likely SafeOpen source

ChainPatrol URLQuery Google Safe Browsing SSL Labs Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/65443.xyz"
  title="PhishDestroy threat report for 65443.xyz"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>