m96u[.]xyz

The domain m96u.xyz was registered on July 27 2025 through Gname.com Pte. Ltd. and currently resolves to the IPv4 address 45.196.247.180, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. No TLS certificate is presented for the host, indicating that HTTPS is not available. The site’s HTTP endpoint is reported as offline at the time of analysis, and the page title returned from the last known snapshot is “welcome‑BET365”, indicating a brand‑impersonation attempt targeting the Bet365 betting platform. The campaign is classified as a crypto‑gambling scam in the intelligence feed.

Infrastructure analysis shows the domain is served by a set of public nameservers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4, ns1.dnsbm.com, ns2.dnsbm.com). The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that 15 of 95 scanned security vendors flagged the domain as malicious, providing additional confirmation of its malicious intent. AlienVault OTX references the domain in three separate threat‑intel pulses, further corroborating its association with fraudulent activity.

Defenders should consider the domain high‑risk given the multi‑vendor detection, blocklist presence, and explicit brand impersonation. Immediate mitigation steps include adding the domain and its resolving IP address to network‑level deny lists, updating URL filtering policies to block any HTTP requests to m96u.xyz, and monitoring for any re‑hosting attempts. Continuous observation of the registrar Gname.com Pte. Ltd. for new registrations that reuse the same nameserver pattern may help anticipate future campaigns. At present, the lack of an SSL certificate and the offline status limit active exploitation, but the infrastructure remains viable for rapid re‑deployment, so proactive blocking is advised.