h101g[.]xyz

The domain h101g.xyz has been identified as a brand impersonation threat specifically targeting Bet365, an online gambling and sports betting platform. Analysis confirms this domain was actively used in phishing campaigns designed to deceive users into divulging login credentials, financial details, or personal information under the guise of the legitimate Bet365 brand. As of the latest assessment, the domain has been taken offline, though residual risks may persist due to prior exposure. Infrastructure analysis reveals critical technical indicators associated with this threat. The domain was registered through Gname.com Pte. Ltd. on March 04, 2026, and resolved to the IP address 103.233.249.125, hosted within the Hong Kong-based autonomous system AS132839 (POWER LINE DATACENTER). Notably, the domain lacked SSL encryption, increasing the likelihood of interception during data transmission. Detection metrics further substantiate its malicious nature: 21 of 95 security vendors on VirusTotal flagged h101g.xyz as malicious, while it appeared on one security blocklist. The page title, 'welcome-BET365,' directly corroborates its intent to impersonate the Bet365 platform. Current status indicates the domain is no longer active, reducing immediate exposure risks. However, users who may have interacted with the site prior to its takedown should take proactive measures. It is recommended to reset credentials for any accounts accessed via this domain, monitor financial statements for unauthorized transactions, and deploy endpoint protection tools to detect potential malware infections. Organizations should update internal blocklists to include this domain and its associated IP address. Given the elevated risk profile, continuous vigilance is advised, particularly for users within the online gambling sector.