z25r[.]xyz

The domain z25r.xyz has been identified as a brand impersonation threat specifically targeting Bet365, a well-known online gambling platform. This domain is currently offline, but prior analysis indicates it was actively used for fraudulent purposes. The threat type is confirmed as brand impersonation, designed to deceive users into believing they are interacting with the legitimate Bet365 service. Analysis reveals that z25r.xyz was flagged by 18 of 95 security vendors on VirusTotal, indicating a significant level of detection. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 103.233.249.125, hosted in Hong Kong under AS132839 (POWER LINE DATACENTER). Notably, the domain lacks an SSL certificate, a red flag for user security. It appears on one security blocklist and was previously blocked by a specialized anti-fraud system. The page title, 'welcome-BET365,' further confirms the intent to impersonate the Bet365 brand. Current infrastructure analysis indicates the domain has been taken offline, reducing immediate risk to users. However, the technical indicators associated with this domain—such as its registration details, lack of encryption, and hosting provider—suggest a pattern consistent with malicious activity. Organizations and individuals are advised to block the domain and its associated IP (103.233.249.125) at the network level. Users should verify the authenticity of any communication or website claiming affiliation with Bet365 by cross-referencing official domains and ensuring the presence of a valid SSL certificate. Monitoring for similar domains registered through the same registrar or hosted on the same IP range is recommended to preempt further threats.