r34m[.]xyz

The domain r34m.xyz was registered on 2026-01-01 through Gname.com Pte. Ltd. and is currently associated with a set of six name servers: ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4. The authoritative DNS resolves to the IPv4 address 45.196.247.147, which belongs to the autonomous system AS140224 operated by Nebula Global LLC and is geolocated in Hong Kong. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP when it was reachable. The page title returned by the server was "welcome-BET365", and the brand target is explicitly listed as Bet365. The listed scam type is "Crypto Gambling", suggesting that the infrastructure was intended to lure victims into a fraudulent gambling or cryptocurrency investment scenario using the Bet365 brand.

VirusTotal has recorded that 16 of 93 scanning engines flagged the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has also taken the domain offline, and the current status is recorded as offline. An AlienVault OTX pulse references the domain in one threat‑intelligence feed, confirming that it has been observed in the wild. The lack of an SSL certificate, combined with the absence of any known safe‑browsing designation, further reduces the trustworthiness of the host. Evidence gaps remain: the exact content served at the URL, the presence of any credential‑harvesting forms, and the specific malware or payload delivery mechanisms have not been publicly disclosed.

Additionally, the short registration window (less than seven months) and the rapid takedown suggest a transient campaign. Defenders should block r34m.xyz at the network perimeter, add the resolved IP 45.196.247.147 to deny‑list rules, and monitor for any DNS queries to the listed name servers. Threat‑intel platforms should continue to reference the OTX pulse and update indicators of compromise as additional artifacts become available.