s97j[.]xyz

Analysis of s97j.xyz shows that the domain was registered on 21 February 2026 and resolves to the IPv4 address 45.196.247.146, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. The TLS certificate presented is identified as R12, a short‑lived certificate commonly used by fast‑flux or malicious operators. The site title retrieved before takedown was "welcome‑BET365", and the domain is explicitly listed as impersonating the Bet365 betting brand. Threat intelligence sources classify the activity as a crypto‑gambling scam, and the domain appears on one public blocklist as well as the PhishDestroy blocklist.

AlienVault OTX records a single pulse referencing the domain, indicating limited but existing community reporting. VirusTotal scans returned detections from 11 of 93 security engines, confirming that multiple vendors consider the host malicious. The current status is offline, so no HTTP response is observed, but the historical evidence is sufficient to treat the domain as hostile. Uncertainty remains regarding the exact payload or phishing page content, as the site was taken down before a full content capture could be performed.

Defenders should immediately deny any outbound connections to 45.196.247.146, add s97j.xyz to DNS and URL filtering policies, and monitor for newly registered domains that resolve to the same ASN or share similar naming patterns. Continuous observation of Nebula Global LLC IP ranges is advised, as they have been employed in other illicit campaigns. The combination of brand impersonation, malicious certificate, multiple vendor detections, and blocklist listings warrants an elevated risk posture.