g33f[.]xyz

Analysis of g33f.xyz, created on 22 December 2025 and currently taken offline, shows a clear brand‑impersonation campaign targeting Bet365. The site presented the page title "welcome-BET365" and was classified as a crypto‑gambling scam in the intelligence feed. Technical infrastructure indicates resolution to IP 45.196.247.160, hosted in Hong Kong under ASN140224 (Nebula Global LLC). No SSL certificate is associated with the domain, confirming that any hosted content would have been delivered over HTTP only.

Nameserver configuration lists ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4., reflecting a multi‑provider setup often used to increase resilience. The registrar is Gname.com Pte. Ltd. Security telemetry shows the domain was flagged by 12 of 93 VirusTotal scanners, received a Gridinsoft trust score of 0 / 100, appears on one public blocklist, and is blocked by the PhishDestroy service. AlienVault OTX reference includes two threat‑intel pulses mentioning the same host.

The combination of brand‑specific page title, low trust scores, and multiple detections strongly suggests an active impersonation effort that was likely used to lure Bet365 users into a fraudulent crypto‑gambling scheme. Defenders should ensure the domain is added to URL filtering and DNS sinkhole policies, block the associated IP address, and monitor for any residual traffic or credential leakage that may have originated before the takedown. Continuous observation of the registrar and nameserver changes is advised, as threat actors may repurpose the domain or its infrastructure for similar campaigns.