r19b[.]xyz

The domain r19b.xyz was registered on 21 February 2026 and is presently taken offline. Network analysis shows the domain resolves to the IPv4 address 103.233.249.125, which is hosted in Hong Kong and advertised as part of AS132839 POWER LINE DATACENTER. The TLS certificate presented is a TrustAsia DV TLS RSA CA 2025 certificate, indicating a standard domain‑validated certificate issued in 2025. The site’s page title is “welcome‑BET365”, and the intelligence feed tags the domain as impersonating the Bet365 brand in a crypto‑gambling scam.

AlienVault OTX lists the domain in a single threat‑intelligence pulse, and the Gridinsoft trust score is recorded as 0 out of 100, reflecting a highly untrusted reputation. PhishDestroy has already added the domain to its blocklist, and it also appears on one additional security blocklist. VirusTotal scans have returned detections from 13 of 93 security vendors, confirming that multiple scanners flag the domain as malicious. The available evidence confirms that r19b.xyz was used to lure victims under the guise of Bet365 and to promote a cryptocurrency gambling scheme.

However, because the site is currently offline, active payload delivery cannot be observed, and the exact content of the landing page beyond the title remains unknown. Defenders should continue to block the domain at perimeter defenses, update URL filtering and DNS sinkhole rules, and monitor for any re‑hosting attempts that reuse the same IP range or SSL certificate fingerprint. Incident response teams should also correlate any internal logs that reference connections to 103.233.249.125 or TLS handshakes with the TrustAsia certificate, as these may indicate compromised endpoints attempting to reach the now‑inactive site. Ongoing threat‑intel feeds should be watched for re‑appearance of the domain or for newly registered look‑alike domains targeting the Bet365 brand.