f112y[.]xyz

The domain f112y.xyz was registered on August 11, 2025 through Gname.com Pte. Ltd. and presently resolves to the IPv4 address 45.196.247.191, which is advertised as belonging to AS140224 Nebula Global LLC and is geolocated in Hong Kong. The authoritative name servers listed for the zone are ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4 (the fourth entry appears truncated). No TLS certificate is presented for the host, indicating the site operated without HTTPS protection. HTTP requests to the domain returned a page whose title element is "welcome-BET365", directly referencing the targeted brand Bet365.

The associated scam type is identified as Crypto Gambling, suggesting the malicious payload was intended to lure victims into a fraudulent gambling scheme involving cryptocurrency. VirusTotal analysis recorded 13 positive detections out of 95 scanned security vendors, confirming that multiple commercial scanners flag the domain as malicious. The domain appears on a single external blocklist and has been specifically blocked by PhishDestroy. Current status is listed as offline, meaning the site is no longer reachable, but historic indicators remain relevant for threat intelligence.

Observed data points are limited to the registration record, DNS configuration, IP ownership, page title, and vendor detections; no additional content, HTTP status codes, or SSL/TLS details have been captured. Defenders should continue to block the domain and its resolving IP at perimeter and endpoint controls, incorporate the observed page title and DNS patterns into detection rules, and monitor for newly registered domains using the same registrar, name server set, or ASN for potential reuse. Ongoing surveillance of related crypto‑gambling lure campaigns targeting Bet365 will aid in early identification of similar impersonation attempts.