p86p[.]xyz

Analysis of p86p.xyz shows a recent domain created on 28 August 2025 that is currently taken offline. The domain resolves to 45.196.247.162, an address assigned to Nebula Global LLC in Hong Kong (AS140224). The hosting infrastructure is shared among multiple nameservers – ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. – a pattern frequently observed in fast‑flux or disposable hosting used for illicit campaigns. No TLS certificate is presented, indicating that only unencrypted HTTP connections were offered when the site was active.

The page title returned by the server, “welcome‑BET365”, and the intelligence tag “Impersonates: Bet365” confirm that the domain was intended to masquerade as the online betting brand Bet365. The associated scam type is listed as “Crypto Gambling”, suggesting that the site attempted to lure victims into fraudulent cryptocurrency betting schemes. VirusTotal scans have flagged the domain in 13 of 95 security vendors, and AlienVault OTX references it in 15 threat‑intelligence pulses, reflecting moderate detection consensus across independent feeds. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy filtering service. Registrar information shows registration through Gname.com Pte. Ltd., a registrar known to host a variety of legitimate and malicious domains.

The limited public evidence does not disclose the specific phishing kit or payload used, and the exact content of the landing page remains unverified because the site is offline. Consequently, the full scope of the malicious activity cannot be quantified at this time. Defenders should add p86p.xyz and its resolved IP address 45.196.247.162 to deny‑list rules on perimeter firewalls and DNS filtering solutions. Monitoring for resurgence of the domain or re‑use of the same hosting infrastructure is advised, as threat actors often recycle nameservers and IP blocks for new campaigns.