f101w[.]xyz

Analysis as of July 24, 2026 indicates that the domain f101w.xyz is being used to impersonate the online betting brand Bet365. The site presented a page title of “welcome‑BET365”, which aligns with the declared brand target. The domain was registered through Gname.com Pte. Ltd. on June 17, 2025 and is currently taken offline, but historical records show it resolved to the IPv4 address 45.196.247.200. The IP is assigned to Nebula Global LLC in Hong Kong under ASN 140224. Four name servers—ns1.1111343.com through ns4.1111343.com—served the domain, suggesting a single‑provider hosting arrangement. Reputation services flag the domain as highly risky.

ScamAdviser assigned a trust score of 1 / 100, and the site appears on one security blocklist. PhishDestroy listed the domain as blocked, and AlienVault OTX contains 16 pulses referencing the same indicator. VirusTotal recorded 11 detections out of 95 scanned security vendors, reinforcing the malicious classification. No SSL certificate was observed, meaning communications were unencrypted and potentially vulnerable to interception. The available evidence points to a crypto‑gambling scam that leverages the Bet365 brand to lure victims, but the exact payload, credential‑capture mechanisms, and victim interaction flow have not been captured because the site is offline.

Consequently, the full extent of the threat—such as whether the domain hosted malicious binaries or redirected to additional infrastructure—remains uncertain. Defenders should immediately add f101w.xyz and its resolved IP address 45.196.247.200 to network blocklists and configure URL filtering to deny any HTTP or HTTPS request to the domain. Monitoring for future DNS resolutions to the same name servers or similar IP ranges is advisable, as the operators may reuse the infrastructure for new campaigns.