w22h[.]xyz

The domain w22h.xyz was registered on August 15, 2025 through Gname.com Pte. Ltd. and is presently taken offline. DNS resolution points to the IPv4 address 45.196.247.162, which is hosted in Hong Kong and is announced by AS140224 belonging to Nebula Global LLC. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a highly malicious profile. Analysis of threat‑intelligence feeds shows that the domain appears in fifteen AlienVault OTX pulses, suggesting that it has been observed in multiple independent investigations.

VirusTotal reports that twelve of ninety‑five scanned security vendors flagged the domain, reinforcing its malicious classification. The site presents the page title “welcome‑BET365”, directly referencing the Bet365 brand, and the intelligence tags the operation as a “Crypto Gambling” scam that impersonates Bet365. No SSL/TLS certificate is presented for the domain, meaning all HTTP traffic would be unencrypted. Nameserver records are distributed across ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4., and ns1.dnsbm.com, ns2.dnsbm.com, a pattern often seen in fast‑flux or disposable hosting setups.

While the exact content of the landing page has not been captured, the combination of brand impersonation, crypto‑gambling motive, low trust score, multiple threat‑intel mentions, and vendor detections provides strong evidence of a malicious campaign. Defenders should add w22h.xyz to blocklists, monitor outbound connections to its IP address, and enforce strict e‑mail filtering for any Bet365‑related communications that reference this domain. Continuous scanning of the associated IP range and nameservers is recommended to detect any re‑hosting attempts.