p80h[.]xyz

On July 23, 2026 analysts observed that the domain p80h.xyz resolves to the IP address 45.196.247.200, which is registered to Nebula Global LLC in Hong Kong under ASN 140224. The domain was registered on July 29, 2025 through Gname.com Pte. Ltd., and its authoritative name servers are listed as ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4., ns1.dnsbm.com, and ns2.dnsbm.com. No TLS certificate is presented for the host, indicating that HTTPS is not available. The HTTP service has been taken offline at the time of this check, but historical records show the page title "welcome-BET365," which directly references the Bet365 brand and suggests an impersonation attempt. The threat profile is further corroborated by classification as a crypto‑gambling scam, consistent with the use of a popular betting brand to lure victims into fraudulent betting or cryptocurrency transactions.

Threat intelligence aggregation shows the domain appears in fifteen AlienVault OTX pulses and has been flagged by fifteen of ninety‑five VirusTotal scanners. It is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. These detections indicate a moderate to elevated risk posture despite the current offline status. The presence of multiple name servers, a Hong Kong‑based hosting provider, and a lack of SSL suggest a disposable infrastructure commonly used for short‑lived phishing campaigns.

Uncertainty remains regarding the exact content that was served before the takedown, as no live page analysis is available. Defenders should continue to monitor the IP address 45.196.247.200 for any resurgence of activity, enforce URL filtering for p80h.xyz across enterprise proxies, and ensure that users are warned against unsolicited Bet365‑related communications that reference cryptocurrency or gambling.