e119c[.]xyz

The domain e119c.xyz was registered on December 14, 2025 through Gname.com Pte. Ltd. and is currently taken offline. It resolves to the IP address 45.196.247.144, which is announced as belonging to AS140224 Nebula Global LLC and geolocated to Hong Kong. No SSL certificate is present, indicating that the site was served over plain HTTP before being taken down. The page title observed during the brief active period was "welcome-BET365," and the threat is classified as a crypto‑gambling scam that impersonates the Bet365 brand.

The domain appears on a single security blocklist and has been blocked by PhishDestroy. In the open‑source intelligence ecosystem, it is referenced in one AlienVault OTX pulse, and VirusTotal records show that 15 of 93 scanned security vendors flagged the domain as malicious. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the malicious assessment. The limited detection footprint suggests the campaign was short‑lived or quickly mitigated, but the combination of brand impersonation, crypto‑gambling lure, and low‑reputation hosting warrants continued vigilance.

Defenders should ensure the domain is added to local and network‑wide blocklists, monitor the associated IP address for any resurgence of activity, and consider correlating inbound traffic logs for similar patterns targeting Bet365 users. Because the site lacks TLS, any attempt to access it would expose clear‑text communications, further underscoring the risk of credential harvesting. Ongoing threat‑intel feeds should be queried for new pulses referencing e119c.xyz or its hosting infrastructure to detect any re‑use in future campaigns.