j298l[.]xyz

The domain j298l.xyz has been identified as a threat involved in brand impersonation, specifically targeting Bet365. No drainer kit has been detected on this domain. The threat poses an elevated risk due to its impersonation of a well-known brand, which can lead to significant financial and reputational damage if users are misled.

Infrastructure analysis reveals that j298l.xyz has a VirusTotal score of 22/95, indicating that 22 out of 95 security vendors flag this domain as malicious. The domain is registered through Gname.com Pte. Ltd. and resolves to the IP address 45.196.247.25, which is located in Hong Kong and is part of the AS140224 Nebula Global LLC network. The domain was created on February 27, 2026, and appears on one security blocklist. Additionally, the domain is listed as blocked by PhishDestroy.

The current status of j298l.xyz is offline, which suggests that the domain has been taken down as a result of security measures or domain takedown efforts. Despite this, the domain remains a concern due to its previous malicious activity and the elevated risk it posed while active. It is recommended that security teams continue to monitor the domain for any signs of reactivation and ensure that users are educated on the dangers of brand impersonation attacks. The lack of an SSL certificate and the presence of multiple security flags further underscore the need for vigilance.