s95c[.]xyz

Analysis of the domain s95c.xyz indicates a clear case of brand impersonation targeting Bet365. The site, registered on February 21, 2026, presented a page title of "welcome-BET365" and was classified as a crypto gambling scam. Infrastructure inspection shows the domain resolves to IP address 45.196.247.144, which is hosted in Hong Kong and belongs to AS140224 Nebula Global LLC. The SSL certificate presented is identified as R13, a common indicator of low‑cost or fraudulent certificates.

Reputation services provide corroborating evidence: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, with PhishDestroy explicitly blocking it. Threat intelligence feeds add further weight; AlienVault OTX cited the domain in two separate pulses, and VirusTotal recorded detections from 14 of 93 scanning engines, reflecting a notable level of malicious classification. The domain is currently listed as offline, suggesting the operators may be pausing activity or have taken the site down after detection.

Defenders should continue to block the IP 45.196.247.144 and the domain s95c.xyz at network perimeter controls, monitor for any re‑registration attempts, and incorporate the observed indicators—page title, SSL fingerprint, trust score, and detection counts—into threat‑intel feeds. Ongoing vigilance is advised, given the combination of brand impersonation, low trust scoring, and multiple vendor detections, which together denote an elevated risk profile for potential future campaigns.