h35h[.]xyz

Analysis of h35h.xyz indicates that the domain is being used for a brand‑impersonation campaign targeting the online gambling service Bet365. The site’s title, "welcome‑BET365", was observed before the domain was taken offline, matching the declared brand target and confirming the intent to mislead users. Registration data shows the domain was created on 27 July 2025 and was registered through Gname.com Pte. Ltd., a registrar commonly associated with disposable or low‑cost registrations. The authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, ns3.1111343.com, and ns4., which resolve the domain to the IPv4 address 45.196.247.200. Geo‑IP lookup places the address in Hong Kong and links it to AS140224 (Nebula Global LLC).

No TLS certificate is presented, meaning the site can only be accessed over HTTP, which further reduces credibility and may be used to evade certain scanning techniques. Threat‑intel correlation shows the domain appears in four AlienVault OTX pulses and is listed on one public security blocklist. The PhishDestroy blocklist has already flagged it, and VirusTotal reports that 15 of 95 security vendors classify the domain as malicious, reinforcing the suspicion. The campaign is labeled as a "Crypto Gambling" scam, suggesting that victims may be directed to a fraudulent gambling portal that solicits cryptocurrency payments.

Because the domain is currently offline, active content cannot be inspected, and the exact payload or phishing page structure remains unknown. Nevertheless, the combination of brand impersonation, malicious classification by multiple vendors, and infrastructure tied to a known malicious host provides sufficient evidence for defensive action. Organizations should add h35h.xyz to URL filtering and DNS blocklists, monitor traffic to 45.196.247.200, and consider adding the associated name servers to threat‑intel feeds.