m20v[.]xyz

This domain, m20v.xyz, is flagged as a brand impersonation threat targeting Bet365, a well-known gambling platform. Analysis indicates the site was designed to operate as a crypto gambling scam, as explicitly classified in available threat intelligence. The domain was registered on December 20, 2025, through Gname.com Pte. Ltd., and has since been taken offline following detection. Infrastructure analysis reveals the domain resolved to IP address 45.196.247.160, hosted on AS140224 (Nebula Global LLC) in Hong Kong, a network frequently associated with fraudulent activity.

No SSL certificate was present, increasing the likelihood of insecure data transmission. The page title, 'welcome-BET365,' provides concrete evidence of brand impersonation, aligning with the reported scam type. Detection data shows the domain appears on at least one security blocklist and was flagged by 11 of 93 security vendors in a VirusTotal scan, further confirming its malicious classification. The domain is currently blocked by PhishDestroy and remains offline as of the latest verification.

While the exact content and functionality of the site were not analysed, the combination of infrastructure indicators, detection vendor flags, and brand impersonation strongly supports its classification as a fraudulent operation. Defenders should treat this domain as a confirmed threat and maintain blocking measures. Given its offline status, no immediate user exposure is expected, but monitoring for re-activation or related domains on the same infrastructure is recommended. The absence of SSL and the use of nameservers linked to other suspicious domains (ns1.1111343.com, ns2.dnsbm.com) suggest a pattern of low-effort, high-volume phishing deployments, typical of crypto gambling scams targeting users of established platforms.