s114l[.]xyz

The domain s114l.xyz has been identified as a high-risk phishing infrastructure actively impersonating Bet365, a well-known online gambling platform. The site was operational under the page title 'welcome-BET365,' explicitly targeting users of the legitimate Bet365 service. As of the latest verification, the domain has been taken offline, though prior activity classifies it as a brand impersonation threat with confirmed malicious intent. Analysis of s114l.xyz reveals multiple technical indicators of compromise. The domain was registered on March 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolved to the IP address 45.196.247.27, located in Hong Kong and hosted by Nebula Global LLC, an autonomous system with a history of sheltering phishing operations. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data. Security vendors on VirusTotal flagged the domain as malicious, with 24 out of 95 engines detecting it as phishing. Google Safe Browsing also classified it as a phishing threat, and it appeared on at least one security blocklist. The absence of encryption, combined with the domain’s rapid takedown, suggests a short-lived but high-impact campaign. Current status indicates s114l.xyz is offline, though the underlying infrastructure remains a potential vector for future attacks. Organizations and users are advised to block the domain and its associated IP (45.196.247.27) at the network perimeter. Security teams should monitor for newly registered domains under the same registrar or hosting provider, particularly those mimicking gambling or financial services. End users should verify the legitimacy of any Bet365-related communications by cross-referencing official domains and enabling multi-factor authentication on sensitive accounts. Proactive threat hunting for related indicators, such as the page title 'welcome-BET365,' is recommended to preempt similar campaigns.