p67o[.]xyz

Analysis of the domain p67o.xyz indicates it was actively used for brand impersonation targeting Bet365, specifically in a crypto gambling scam. The domain was registered on June 12, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent infrastructure. Infrastructure analysis reveals the domain resolved to the IP address 45.196.247.162, hosted under AS140224 (Nebula Global LLC) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted traffic interception.

The page title, 'welcome-BET365,' directly references the targeted brand, confirming the intent to deceive users into believing the site was affiliated with the legitimate Bet365 platform. The domain appears on at least one security blocklist (PhishDestroy) and has been flagged in 17 threat intelligence pulses on AlienVault OTX, suggesting prior detection by multiple security teams. VirusTotal records show 12 of 95 security vendors marked the domain as malicious, though this does not represent a comprehensive verdict. Nameservers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.111343.com) are consistent with patterns observed in other phishing campaigns, though no direct ties to known phishing kits were identified in the available data.

As of July 23, 2026, the domain is offline, reducing immediate risk to end users. However, defenders should monitor for reactivation or migration to similar infrastructure, particularly under the same registrar or hosting provider. Organizations should update blocklists to include this domain and its associated IP, and consider proactive DNS sinkholing for known malicious nameservers. The exact content and functionality of the site remain unanalyzed, but the available evidence confirms its use in a crypto gambling scam impersonating Bet365.