j175q[.]xyz

Analysis of the domain j175q.xyz indicates it was actively impersonating Bet365, a known gambling platform, with a focus on crypto gambling scams. The domain was registered on June 28, 2025, through Gname.com Pte. Ltd., and has since been taken offline as of the report date. Infrastructure analysis reveals the domain resolved to the IP address 45.196.247.145, hosted under AS140224 (Nebula Global LLC) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted traffic and potential interception risks. The domain's nameservers—ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4.dnsbm.com—are consistent with patterns observed in other fraudulent gambling operations, though no direct ties to known bulletproof hosting providers are confirmed in the available data.

Detection metrics further support the domain's malicious classification. Eleven of ninety-five security vendors on VirusTotal flagged j175q.xyz as malicious, while AlienVault OTX lists it in sixteen distinct threat intelligence pulses, suggesting widespread recognition of its fraudulent nature. The domain appears on at least one security blocklist, specifically PhishDestroy, and received a trust score of 0/100 from Gridinsoft, reinforcing its elevated risk level. The page title, 'welcome-BET365,' directly aligns with the impersonation of the Bet365 brand, though no additional content analysis is available to confirm specific scam mechanics or user interaction flows.

Defenders should treat this domain as a confirmed brand impersonation threat, particularly for crypto gambling fraud. The absence of SSL and the domain's offline status limit further live analysis, but historical resolution data and detection metrics provide sufficient evidence for blocking and monitoring. Organizations should cross-reference the IP address 45.196.247.