f216d[.]xyz

The domain f216d.xyz was registered on 24 December 2025 through Gname.com Pte. Ltd. and is presently taken offline. DNS resolution points to the single IPv4 address 45.196.247.147, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. The authoritative name servers are a set of six entries (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4., ns1.dnsbm.com, ns2.dnsbm.com), indicating a multi‑provider configuration that is typical of fast‑flux or disposable hosting used in fraudulent campaigns. No TLS certificate is presented; the site is reachable only via HTTP, which further reduces credibility.

Static content retrieved before takedown displayed the page title “welcome‑BET365”, directly referencing the betting brand Bet365. The threat classification is recorded as a crypto‑gambling impersonation, consistent with the brand‑target field. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain is listed on a single security blocklist. PhishDestroy has actively blocked the host, and VirusTotal reports that fifteen of ninety‑three scanning engines flagged the domain for malicious behavior, reinforcing the suspicion of abuse.

The observable evidence confirms a deliberate attempt to masquerade as Bet365 in order to lure victims into a cryptocurrency‑based gambling scheme. However, the offline status prevents real‑time verification of any credential‑capture or payment‑drain mechanisms, and the exact payload or redirect chain remains unknown. Defenders should continue to monitor the IP address 45.196.247.147 for any resurgence, enforce network‑level blocking of the domain and its host, and propagate the indicator set (domain, IP, name‑server list, page‑title) to threat‑intelligence feeds. Updating endpoint and web‑gateway filters with the current detection signatures will help mitigate exposure to similar brand‑impersonation campaigns.