z20u[.]xyz

Analysis of the domain z20u.xyz, created on 26 August 2025 and currently listed as offline, shows a clear pattern of brand impersonation targeting Bet365. The site presented the page title “welcome‑BET365”, indicating an attempt to lure Bet365 customers into a crypto‑gambling scheme. Registration data ties the domain to Gname.com Pte. Ltd., and the authoritative nameservers are ns1.1111343.com through ns4.1111343.com. DNS resolution points to IP address 45.196.247.180, which belongs to AS140224 Nebula Global LLC and is geolocated in Hong Kong. No TLS certificate is deployed, meaning the site operated without HTTPS protection.

Malware and phishing detection services have flagged the domain: VirusTotal recorded 12 detections out of 95 scanned engines, and the domain appears on one public security blocklist. Independent security products assign a Gridinsoft trust score of 0 out of 100, and PhishDestroy has actively blocked the host. AlienVault OTX includes the domain in six separate threat pulses, reinforcing its association with malicious activity. The combination of brand impersonation, crypto‑gambling lure, and multiple independent detections suggests a high likelihood of credential harvesting or financial fraud.

Defenders should add z20u.xyz to DNS blocklists, deny outbound traffic to 45.196.247.180, and monitor for any related domains that share the same nameserver pattern or registration details. Continuous observation of the IP range owned by Nebula Global LLC is advised, as infrastructure reuse is common in these campaigns. Because the site is currently offline, immediate incident response may focus on preventing re‑hosting attempts and ensuring that any previously harvested credentials are revoked or reset. Organizations that use Bet365 services should alert users to the specific threat vector and remind them to only access the official Bet365 domain over HTTPS.