u89y[.]xyz

Analysis of the domain u89y.xyz indicates it was actively used for brand impersonation targeting Bet365, a known gambling platform, with a focus on crypto-gambling scams. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 45.196.247.25, hosted on AS140224 (Nebula Global LLC) in Hong Kong. Infrastructure analysis reveals the domain used nameservers ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, and ns2.dnsbm.com, which may be associated with other malicious activity, though no direct links to known phishing kits were identified in the available data. The page title captured from the site was 'welcome-BET365,' confirming the intent to impersonate the Bet365 brand. No SSL certificate was present, which is atypical for legitimate gambling platforms and increases the likelihood of credential interception.

The domain was flagged by 18 of 93 security vendors on VirusTotal, though this does not represent a comprehensive assessment of its maliciousness. It appeared on one security blocklist and was included in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed detection by the security community. The domain was also blocked by PhishDestroy prior to being taken offline. As of July 23, 2026, the domain is offline, and no active HTTP responses are observed.

Defenders should treat any prior resolution to 45.196.247.25 as indicative of malicious infrastructure, particularly for gambling-related phishing. Organizations are advised to review logs for connections to this IP or domain, particularly in contexts involving crypto-gambling or Bet365 brand mentions. While the domain is no longer active, the nameservers and hosting provider may still be leveraged for future campaigns, warranting continued monitoring. No additional details about the phishing kit, lure mechanisms, or victim targeting are available at this time.