g60l[.]xyz

The domain g60l.xyz was registered on January 14, 2026 through Gname.com Pte. Ltd. and is currently listed as offline. DNS resolution points to the IP address 45.196.247.25, which belongs to Nebula Global LLC (AS140224) and is geolocated in Hong Kong. An SSL certificate identified as R13 is active for the domain, indicating the site was served over HTTPS. The HTTP response includes a page title of "welcome-BET365," directly referencing the targeted brand Bet365. This aligns with the classified scam type of crypto gambling and confirms the domain’s purpose as a brand impersonation effort.

Threat intelligence shows the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft’s trust scoring engine rates the domain at 0 out of 100, reflecting an extreme lack of credibility. VirusTotal analysis records 10 detections out of 93 scanning engines, reinforcing the malicious assessment. Additionally, AlienVault OTX references the domain in a single threat‑intel pulse, providing further corroboration of its malicious nature.

Given the limited public information beyond the page title, the exact content and phishing mechanisms remain unverified. However, the convergence of HTTPS usage, brand‑specific page title, low trust score, multiple vendor detections, and blocklist presence indicates a high confidence that g60l.xyz was used to lure Bet365 users into a crypto gambling scam. Defensive actions should include immediate blocking of the domain at perimeter and DNS filters, adding the associated IP address 45.196.247.25 to deny‑list rules, and monitoring for any transient re‑hosting attempts under related subdomains. Security teams should also update URL filtering solutions with the domain and ensure endpoint protection tools are aware of the 10 VirusTotal detections. Continuous observance of the registrar Gname.com Pte. Ltd. for new registrations resembling g60l.xyz may help preempt future impersonation campaigns targeting the Bet365 brand.