u72t[.]xyz

This domain, u72t.xyz, is assessed as a confirmed phishing site impersonating the Bet365 brand, targeting users with a crypto gambling scam. Analysis indicates the domain was registered on November 16, 2025, through Gname.com Pte. Ltd., a registrar frequently observed in fraudulent campaigns. Infrastructure analysis reveals the domain resolves to the IP address 45.196.247.147, hosted under AS140224 (Nebula Global LLC) in Hong Kong. The nameservers—ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com—are consistent with patterns seen in other malicious domains, suggesting shared infrastructure. At the time of assessment, the domain lacks an SSL certificate, increasing the likelihood of unencrypted data transmission and further signaling potential malicious intent.

Security vendor detections on VirusTotal report 18 of 95 engines flagging the domain as malicious, a detection rate that supports its classification as a phishing threat. AlienVault OTX records the domain in 15 threat intelligence pulses, indicating prior identification in active phishing or scam campaigns. The domain appears on one security blocklist, specifically PhishDestroy, which has taken action to block it. The page title, 'welcome-BET365,' directly references the targeted brand, confirming the intent to deceive users into believing they are interacting with a legitimate Bet365 platform. As of July 23, 2026, the domain is offline, though defenders should treat it as a persistent threat until further remediation is confirmed.

The absence of an SSL certificate, combined with the domain's hosting in a region with a history of abuse, reinforces the need for caution. Defenders are advised to block the domain and its associated IP (45.196.247.147) at the network level, monitor for related domains registered through the same registrar or nameserver set, and alert users to the Bet365 impersonation scam.