r32y[.]xyz

Analysis of the domain r32y.xyz indicates it was actively used for brand impersonation targeting Bet365, a known gambling platform. The domain was registered on December 20, 2025, through Gname.com Pte. Ltd., and resolved to the IP address 45.196.247.147, hosted under AS140224 Nebula Global LLC in Hong Kong. Infrastructure analysis reveals the use of nameservers ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4.dnsbm.com, which have been associated with other malicious domains in prior investigations. The page title, 'welcome-BET365,' explicitly confirms the intent to impersonate Bet365, aligning with the reported scam type of crypto gambling.

No SSL certificate was detected, increasing the likelihood of insecure data transmission. The domain appears in two AlienVault OTX threat intelligence pulses, suggesting prior malicious activity linked to this infrastructure. As of the report date, the domain is offline, though it remains flagged by one security blocklist and was blocked by PhishDestroy. VirusTotal records indicate that 11 out of 93 security vendors classified this domain as malicious, though the absence of a full scan or additional context limits the interpretability of this data.

Defenders should treat this domain as part of a broader phishing campaign targeting gambling users, particularly those involved in cryptocurrency transactions. The hosting provider and nameserver patterns may be useful for identifying related malicious infrastructure. While the domain is currently inactive, monitoring for re-emergence or similar domains under the same registrar or hosting provider is recommended. No further details about the exact content or functionality of the phishing page are available at this time.