p54x[.]xyz

Analysis of the domain p54x.xyz, observed on July 23 2026, indicates that it was actively used to impersonate the Bet365 brand. The site presented the page title “welcome‑BET365”, aligning with the declared brand target. The domain was registered on May 21 2025 through Gname.com Pte. Ltd., and its authoritative name servers are ns1.1111343.com, ns1.dnsbm.com, ns2.1111343.com, ns2.dnsbm.com, ns3.1111343.com, and ns4. The lack of an SSL certificate suggests that the site operated over plain HTTP, a common trait of fraudulent deployments. Network resolution points to IP address 45.196.247.159, which is allocated to AS140224 owned by Nebula Global LLC and geolocated in Hong Kong.

The same IP is referenced by a single security blocklist, further indicating potential abuse. Reputation services show that fifteen of ninety‑five VirusTotal scanners flagged the domain, confirming a consensus of malicious behavior among independent engines. The domain also appears in fifteen AlienVault OTX pulses, reinforcing its association with threat‑intel reports. Defensive platforms such as PhishDestroy have already added the host to their blocklist, effectively disrupting its delivery. The observed scam type is classified as “Crypto Gambling”, implying that the impersonation likely aimed to lure victims into fraudulent gambling or cryptocurrency schemes under the guise of Bet365.

While the site has been taken offline, the underlying infrastructure—specifically the shared name servers and the hosting AS—remains observable and may be reused for future campaigns. Defenders should continue to monitor the IP 45.196.247.159 and the associated name server domains for re‑appearance, update URL filtering and DNS blocklists accordingly, and enforce TLS inspection to detect any future HTTP‑only payloads.