g32f[.]xyz

Analysis of the domain g32f.xyz indicates a confirmed phishing infrastructure targeting Bet365, classified as a crypto gambling scam. The domain was registered on December 16, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 45.196.247.166, hosted under AS140224 (Nebula Global LLC) in Hong Kong. The absence of an SSL certificate further reduces the legitimacy of the site, as encrypted connections are a baseline expectation for financial or gambling platforms.

The domain's nameservers—ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, and ns2.dnsbm.com—are consistent with patterns observed in other phishing campaigns, suggesting shared or bulletproof hosting infrastructure. Detection metrics corroborate the malicious classification: the domain appears on one security blocklist, and 17 of 95 security vendors on VirusTotal flagged it as malicious. Additional trust assessments reinforce this finding, with Gridinsoft assigning a trust score of 0/100 and Scamadviser providing a score of 1/100. The page title, 'welcome-BET365,' directly aligns with the identified brand impersonation, confirming the intent to deceive users into believing the site is affiliated with the legitimate Bet365 platform.

At the time of this report (July 23, 2026), the domain has been taken offline, though its prior resolution and detection history indicate it was actively used in a phishing campaign. Defenders are advised to block the domain at the DNS level and monitor associated IP addresses and nameservers for further malicious activity. The combination of low trust scores, blocklist inclusion, and brand impersonation evidence justifies an elevated risk classification. No additional content analysis is available, as the site is no longer accessible for inspection.