g87g[.]xyz

Analysis confirms g87g.xyz as a brand-impersonation scam targeting Bet365, operating under the guise of a crypto-gambling platform. The domain was registered on March 9, 2026, through Gname.com Pte. Ltd. and currently resolves to IP 103.233.249.125, hosted in Hong Kong under AS132839 (POWER LINE DATACENTER). Infrastructure analysis reveals the use of four nameservers (ns1.1111343.com through ns4.1111343.com), a configuration often associated with bulletproof hosting providers. The site was detected by 13 of 94 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious.

A single blocklist (PhishDestroy) has flagged the domain, and no SSL certificate is present, further reducing its legitimacy. The page title 'welcome-BET365' provides direct evidence of brand impersonation, aligning with the reported scam type of crypto-gambling. Technologies detected include Vue.js, Nginx, and HSTS, suggesting a modern frontend framework paired with a hardened web server—common in phishing sites aiming to evade detection while maintaining performance. The domain is currently offline, likely due to takedown efforts or operational rotation by the threat actor.

Defenders should treat this domain as confirmed malicious. Indicators of compromise include the IP (103.233.249.125), nameserver cluster (1111343.com), and registrar (Gname.com). Organizations should block the domain at DNS and proxy levels, monitor for related infrastructure (e.g., sibling domains under the same nameservers), and alert users to the Bet365 impersonation risk. While the exact content of the site remains unanalyzed, the combination of brand misuse, scam classification, and detection by security vendors provides sufficient evidence for immediate remediation.