p26z[.]xyz

The domain p26z.xyz was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the address 45.196.247.27, which belongs to ASN 140224 operated by Nebula Global LLC and is geolocated in Hong Kong. The site presented a page titled "welcome-BET365", indicating a direct impersonation of the Bet365 brand and aligning with a crypto-gambling scam narrative. VirusTotal analysis recorded 16 positive detections out of 93 scanning engines, confirming that multiple security products consider the host malicious.

AlienVault OTX lists the domain in two separate threat-intel pulses, further corroborating its use in abusive campaigns. The SSL certificate carries an R13 rating, and Gridinsoft assigned a trust score of 0/100, reflecting a lack of confidence in the certificate’s legitimacy. PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist, demonstrating broader community mitigation.

Because the HTTP service is currently unreachable, direct content inspection was not possible, but the observed page title and brand targeting provide sufficient attribution. Defenders should continue to block both the domain and its hosting IP at perimeter defenses, update URL filtering and DNS sinkhole rules, and monitor for any resurgence of the IP or similar newly-registered domains that reuse the "welcome-BET365" title pattern. Ongoing correlation with VirusTotal and OTX feeds will aid in early detection of re-hosted copies.