s99j[.]xyz

This domain, s99j.xyz, is identified as a brand impersonation threat specifically targeting Bet365, a well-known online gambling platform. The site presents a page titled 'welcome-BET365,' designed to deceive users into believing they are interacting with the legitimate Bet365 service. Brand impersonation of this nature typically aims to harvest user credentials, financial details, or deploy malicious payloads under the guise of a trusted entity. No evidence of a crypto drainer kit or direct malware distribution was observed in this instance, though credential theft remains the primary objective. Analysis of technical indicators reveals multiple red flags associated with s99j.xyz. The domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating a moderate to high level of detection. It was registered on January 4, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 45.196.247.147, located in Hong Kong under AS140224 (Nebula Global LLC), an autonomous system often linked to malicious infrastructure. The SSL certificate is issued by R13, a less common certificate authority that has been observed in other phishing campaigns. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No detections were reported on Google Safe Browsing at the time of analysis. As of the latest assessment, s99j.xyz has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the elevated risk level persists due to the domain's recent registration and the potential for re-emergence under a different infrastructure. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window, particularly those associated with Bet365 or financial services. Organizations should monitor for similar domains registered through Gname.com Pte. Ltd. or resolving to IPs within AS140224, as these indicators may signal additional threats. Proactive blocking of the identified IP and domain at the network level is recommended to mitigate residual risk.