f230v[.]xyz

This domain, f230v.xyz, is assessed as a confirmed brand impersonation site targeting Bet365, specifically operating as a crypto gambling scam. Infrastructure analysis reveals the domain was registered on February 14, 2026, through Gname.com Pte. Ltd., and is associated with nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET. The domain resolved to IP address 103.59.145.243, hosted under AS133861 (SonderCloud Limited) in the United States. At the time of assessment, the site was offline, but prior activity included a page title of 'welcome-BET365,' directly indicating an attempt to impersonate the legitimate Bet365 brand.

Security vendor detections on VirusTotal flagged the domain as malicious, with 13 of 95 vendors marking it as a threat. The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its fraudulent nature. No SSL certificate was present, which is atypical for legitimate gambling or financial platforms and aligns with common phishing infrastructure patterns.

Defenders should treat this domain as a high-confidence threat, particularly for users or systems that interact with Bet365 or crypto gambling services. While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis, and any residual DNS resolutions or cached content should be monitored for reactivation attempts. The use of shared nameservers and a hosting provider with a history of abuse suggests potential ties to broader fraud campaigns, warranting cross-referencing with other domains hosted on the same IP or nameserver infrastructure.