a56x[.]xyz

The domain a56x.xyz was registered on December 20, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 45.196.247.147, which belongs to AS140224 Nebula Global LLC in Hong Kong. Authoritative DNS is provided by the nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET. While the site was online it served HTTPS using a TLS certificate identified as R12. The observed page title was “welcome-BET365”, and the domain was explicitly flagged as an impersonation of the Bet365 brand that offered a crypto‑gambling scheme. Current records list the site as taken offline; it has been blocked by PhishDestroy and appears on one security blocklist. AlienVault OTX reports a single pulse referencing this domain, and VirusTotal analysis shows that 16 of 93 scanning engines flagged it as malicious. The blocklist entry and OTX pulse corroborate the brand‑impersonation classification, confirming that multiple independent sources have identified the infrastructure as hostile.

Analysis indicates that the combination of a recent registration, rapid deployment of a Bet365‑related page title, and the use of a Hong Kong‑based hosting provider aligns with tactics seen in crypto‑gambling fraud campaigns targeting Bet365 customers. The limited detection surface—only one blocklist entry and a modest number of VirusTotal detections—suggests a short‑lived operation, yet the presence of multiple security vendors confirms malicious intent. No additional infrastructure such as command‑and‑control servers or payload URLs has been publicly disclosed, leaving the broader campaign scope uncertain.

Defenders should add a56x.xyz to DNS and web filtering deny‑lists, monitor for any future domains that resolve to the same IP address or use the same nameserver pair, and flag any traffic that presents Bet365 branding together with cryptocurrency transaction requests. Continuous monitoring of the hosting ASN and the SSL certificate characteristics is recommended to detect potential re‑use.