f211o[.]xyz

Analysis of f211o.xyz shows a short‑lived domain registered on 24 November 2025 through Gname.com Pte. Ltd. The site resolves to 45.196.247.170, an address in Hong Kong owned by ASN 140224 (Nebula Global LLC). No SSL certificate is present, indicating the service is delivered over HTTP only. The page title returned during the brief online window was “welcome‑BET365”, and the domain is explicitly listed as impersonating the Bet365 brand. The content classification in the intelligence feed labels the operation as a crypto‑gambling scam, although the exact page content could not be captured because the host is currently offline. The domain appears on a single public security blocklist and is actively blocked by PhishDestroy.

AlienVault OTX records the domain in 18 separate threat pulses, reflecting moderate sharing among analysts. VirusTotal scans report that 15 of 95 scanning engines flagged the host, reinforcing the malicious assessment. Independent reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). Nameserver records point to ns1‑ns4.1111343.com, a set of servers frequently observed in other malicious registrations.

Given the convergence of brand impersonation, low reputation metrics, multiple vendor detections, and hosting under a known malicious ASN, defenders should treat f211o.xyz as a high‑confidence malicious indicator. Recommended actions include adding the domain and its IP address to network deny lists, updating DNS filtering policies to block the associated nameservers, and monitoring for any new domains registered by the same registrar or using the same nameserver pattern. Continuous observation of OTX and other threat feeds for emergent pulses referencing this infrastructure is advised. Because the site is offline, any future re‑activation would likely reuse the same infrastructure, so proactive blocking remains essential.