a72e[.]xyz

The domain a72e.xyz was registered on January 13, 2026 through Gname.com Pte. Ltd. The zone uses the public nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET and does not present an SSL/TLS certificate, meaning all HTTP traffic is unencrypted. DNS resolution points to the IPv4 address 45.119.97.37, which is allocated to AS133861 SonderCloud Limited and geolocated to the United States. At the time of analysis the host was taken offline, but the infrastructure remains observable and may be re‑activated. The site’s HTML title reported as "welcome-BET365", and the threat intelligence profile classifies the page as a crypto‑gambling impersonation of the Bet365 brand.

The same domain appears in a single AlienVault OTX pulse and is listed on one external security blocklist, indicating that at least one third‑party feed has flagged it. PhishDestroy also recorded a block event. VirusTotal scanned the domain and 15 of 93 security vendors returned a malicious verdict, reinforcing the malicious classification. Evidence suggests a typical brand‑impersonation kit that lures victims with promises of cryptocurrency gambling tied to the Bet365 name.

No additional content has been captured, so the exact phishing flow and payload remain unknown. Defenders should continue to block the domain and its IP address at network perimeter devices, update DNS filtering policies to deny resolution of a72e.xyz, and monitor the ASN for any new hostnames that resolve to the same address range. Because the registrar and nameserver configuration are public, threat‑hunting queries against Gname.com and the SHARE‑DNS infrastructure may reveal related campaigns. Continuous re‑assessment is advised in case the site is re‑hosted or the certificate is later provisioned.