f109v[.]xyz

Analysis of f109v.xyz, registered on July 27 2025 through Gname.com Pte. Ltd., shows a clear focus on brand impersonation of Bet365. The site’s sole visible artifact is the page title “welcome‑BET365”, which aligns with the declared scam type of crypto gambling. Infrastructure assessment reveals resolution to IP 45.196.247.200, an address located in Hong Kong and attributed to AS140224 Nebula Global LLC. The domain uses a set of six nameservers—ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4.—which are commonly observed in malicious hosting arrangements. No TLS certificate is present, meaning traffic would be unencrypted and vulnerable to interception. VirusTotal scans have flagged the domain in 15 of 95 security engines, indicating a notable detection rate across multiple vendors. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service.

AlienVault OTX lists the indicator in 18 separate threat‑intel pulses, further corroborating its association with malicious campaigns. Reputation services rate the site extremely low, with Scamadviser assigning a trust score of 1 out of 100. Current operational status is offline, which may be a temporary takedown; however, the underlying infrastructure and historical detections suggest the domain remains a viable threat vector should it reappear. Uncertainties include the exact content and functionality of the site prior to takedown, as no screenshots or HTML analysis are available. The lack of an SSL certificate confirms that any credential capture would have occurred over HTTP, but the specific data exfiltration mechanisms cannot be confirmed. Additionally, while the domain is associated with a “crypto gambling” scam type, the precise monetary flow or wallet addresses have not been disclosed.

Defenders should continue to block f109v.xyz at perimeter defenses, DNS filtering, and proxy layers, and add the associated IP 45.