m97p[.]xyz

This domain is flagged as a brand‑impersonation site targeting Bet365. The page title observed during the brief crawl was “welcome‑BET365”, indicating an explicit reference to the betting brand. The domain m97p.xyz was registered on 2 August 2025 through Gname.com Pte. Ltd. and currently resolves to the IPv4 address 43.242.129.10, which is allocated to SonderCloud Limited in Hong Kong under ASN 133199. No TLS certificate is presented; connections are therefore unencrypted.

The name server set consists of ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns1.dnsbm.com, ns2.dnsbm.com, and an incomplete entry “ns4.”, suggesting a rapidly assembled hosting configuration. VirusTotal reports that 13 of 95 scanning engines have flagged the domain, indicating a moderate level of detection across multiple vendors. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. AlienVault OTX lists the host in fifteen distinct threat‑intel pulses, reinforcing its association with malicious activity.

The site is categorized as a crypto‑gambling scam, which aligns with the use of a reputable betting brand to lure victims into fraudulent wagering schemes. The current operational state is offline, but the infrastructure—particularly the hosting IP and name server pattern—remains reusable for future campaigns. Defenders should add m97p.xyz to URL filtering and domain‑blocking policies, enforce outbound restrictions to the IP 43.242.129.10, and monitor for similar name‑server patterns that may indicate related drop‑zones. Continuous retrieval of updated threat‑intel feeds, especially from PhishDestroy and OTX, is recommended to capture any re‑activation or repurposing of the underlying infrastructure.