f228g[.]xyz

Analysis indicates that the domain f228g.xyz was registered on 3 February 2026 through Gname.com Pte. Ltd. The authoritative name server resolves to IP 45.196.247.26, which is assigned to AS140224 (Nebula Global LLC) and geolocated in Hong Kong. The TLS certificate presented is identified as R13, suggesting a low‑grade or possibly self‑signed certificate. The site’s HTML title is "welcome‑BET365", and the domain is explicitly linked to a brand impersonation campaign targeting Bet365, categorized as a crypto‑gambling scam. Reputation data show the domain appearing on a single security blocklist and being blocked by the PhishDestroy service. On VirusTotal, 16 of 93 scanning engines flagged the domain, confirming malicious intent.

Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse. AlienVault OTX references the domain in one threat‑intel pulse, reinforcing its presence in the threat community. The page title and scam type confirm that the operator attempts to lure victims by mimicking Bet365’s brand and possibly soliciting cryptocurrency wagers. The current HTTP status is offline, which limits direct observation of payloads or redirects, but the accumulated indicators are sufficient for defensive action.

Defenders should add f228g.xyz to DNS and URL filtering blocks, deny traffic to the associated IP address, and monitor for other domains resolving to the same IP or registered through the same registrar. Continuous observation of Nebula Global LLC’s address space for additional registrations may reveal related infrastructure. Because the site is already flagged by multiple vendors, inclusion in internal threat‑intelligence feeds is recommended. No further evidence of the page content is available, so future verification should focus on the infrastructure rather than content analysis.