63442[.]xyz

The domain 63442.xyz was registered on 2026-03-09 through Gname.com Pte. Ltd. and is presently taken offline. DNS resolution points to the IPv4 address 45.196.247.27, which is advertised as part of AS140224 owned by Nebula Global LLC and geolocated to Hong Kong. The authoritative name servers are a6.share-dns.com and b6.share-dns.net, both of which are commonly used by disposable hosting services. No TLS certificate was observed for the site, indicating that the service operated without HTTPS encryption.

The web server identified itself as Nginx and delivered client‑side code built with Vue.js; HTTP headers include the Strict‑Transport‑Security directive, suggesting an attempt to enforce secure connections despite the lack of a valid certificate. The page title returned by the HTTP response is “welcome‑BET365”, matching the declared brand target of Bet365 and the listed scam type of crypto gambling. The site was listed on a single security blocklist, PhishDestroy, and has been flagged by 19 of 94 scanning engines on VirusTotal, reflecting a moderate detection rate among public scanners. Evidence indicates that the infrastructure was deliberately crafted to impersonate the Bet365 brand for the purpose of crypto‑related gambling fraud.

Because the site is no longer reachable, real‑time verification of the payload cannot be performed, and the exact content of the landing page remains unconfirmed. Defenders should continue to block the domain and the associated IP address at perimeter defenses, monitor the shared name‑server infrastructure for recurrent abuse, and update threat intel feeds with the observed indicators of compromise. Ongoing vigilance is advised in case the operators redeploy the campaign using new domains that resolve to the same hosting provider or reuse the same Vue.js/Nginx stack.