h35f[.]xyz

The domain h35f.xyz was registered on 27 July 2025 through Gname.com Pte. Ltd. and currently resolves to the IPv4 address 45.196.247.180, which is announced by AS140224 belonging to Nebula Global LLC and geolocated in Hong Kong. The authoritative name servers are ns1.1111343.com through ns4.1111343.com, indicating use of a shared hosting platform often observed in malicious campaigns. No TLS certificate is presented, meaning the site is served over plain HTTP only. The sole page title retrieved before the site was taken offline reads “welcome-BET365”, directly referencing the Bet365 brand. The threat profile classifies the activity as a crypto‑gambling impersonation, targeting users of the Bet365 betting service.

VirusTotal has recorded 13 positive detections out of 95 scanned engines, confirming that multiple commercial scanners flag the domain as malicious. The domain appears on at least one public blocklist and has been added to the PhishDestroy blocklist, demonstrating that network‑level defenses are already aware of the indicator. AlienVault OTX lists the domain in 18 separate threat‑intel pulses, providing additional community corroboration of its malicious nature. The site’s current HTTP status is offline, which limits immediate observation but does not eliminate the risk of re‑activation. Evidence gaps remain regarding the exact payload delivered, the command‑and‑control infrastructure, and whether the domain was ever used to harvest credentials or redirect traffic to a cryptocurrency gambling portal.

No SSL/TLS fingerprint, no content hash, and no known URL paths have been published, so analysts should treat the domain as a potential drop point pending further capture. Defenders should add 45.196.247.180 and the domain h35f.xyz to DNS and URL filtering rules, block the associated name servers, and monitor for any resurgence of the domain or its aliases. Threat‑intel feeds that reference the 18 OTX pulses should be consulted for possible IOC expansions.