b119y[.]xyz

This domain, b119y.xyz, was registered on 12 June 2025 through Gname.com Pte. Ltd. and is presently taken offline. The authoritative nameservers ns1‑ns4.1111343.com resolve the domain to the single IPv4 address 45.196.247.162, which belongs to AS140224 (Nebula Global LLC) and is geolocated in Hong Kong. No TLS certificate is presented, indicating that the site operated only over HTTP. The page title returned from the host was “welcome‑BET365”, and the intelligence tags the campaign as a brand‑impersonation targeting Bet365 with a crypto‑gambling lure.

Scamadviser assigns a trust score of 1 out of 100, and the domain appears on one public security blocklist. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the host as malicious, reinforcing the suspicion of abuse. PhishDestroy has also listed the domain as blocked. The available evidence confirms a deliberate attempt to exploit the Bet365 brand for financial gain, likely by directing victims to a fraudulent gambling service that accepts cryptocurrency.

However, the exact payload, credential‑capture mechanisms, and any associated command‑and‑control infrastructure remain unknown because the site is no longer reachable. Defenders should continue to monitor the IP address 45.196.247.162 for any re‑use, enforce outbound filtering for connections to the domain and its hosting ASN, and add the domain to internal blocklists. Security teams should also flag any email or web traffic that references “welcome‑BET365” or similar Bet365‑related branding as potentially malicious. Ongoing collaboration with sinkhole providers and threat‑share platforms is recommended to detect possible redeployment of the infrastructure.