g32x[.]xyz

On July 23, 2026, the domain g32x.xyz was observed as an offline site that claimed the page title “welcome-BET365”. The title directly references the Bet365 brand, indicating a targeted brand‑impersonation campaign aimed at crypto gambling victims. The domain was registered on December 20, 2025 through Gname.com Pte. Ltd., and its authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and ns4. The domain resolves to the IPv4 address 45.196.247.160, which belongs to the autonomous system AS140224 operated by Nebula Global LLC and is geolocated in Hong Kong. No SSL certificate was presented for the host, meaning the site served only unencrypted HTTP traffic before being taken offline.

Reputation services uniformly rate the infrastructure as highly suspicious: Gridinsoft assigned a trust score of 0 out of 100, and Scamadviser reported a score of 1 out of 100. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis recorded 16 positive detections out of 93 submitted scanners, confirming that multiple security vendors consider the host malicious. AlienVault’s Open Threat Exchange (OTX) includes the domain in one threat‑intel pulse, further corroborating its association with malicious activity.

Given the combination of brand‑specific page title, low trust scores, multiple vendor detections, and the presence of the host on blocklists, the evidence strongly supports classification of g32x.xyz as a crypto‑gambling phishing site that impersonates Bet365. Defenders should add the domain and its resolving IP address to network‑level deny lists, ensure that any endpoint protection solutions are updated to block the host, and monitor for any future re‑registration or resurrection of the domain. Because the site is currently offline, active takedown is not required, but continuous observation of the registrar Gname.