s97k[.]xyz

Analysis indicates that the domain s97k.xyz was registered on 21 February 2026 and is presently taken offline. The site presented the page title “welcome‑BET365”, suggesting a direct impersonation of the Bet365 betting brand. The hosting resolves to IP 103.233.249.125, which belongs to the POWER LINE DATACENTER network (ASN 132839) located in Hong Kong. No TLS certificate was observed, meaning the site operated over plain HTTP.

Threat‑intel aggregators have recorded the domain in multiple sources: PhishDestroy blocked the site, AlienVault OTX includes it in a single pulse, and it appears on one additional security blocklist. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. VirusTotal scans reported 11 of 93 antivirus engines flagging the domain, reinforcing the suspicion. The payload appears to target users seeking cryptocurrency‑based gambling, consistent with the “Crypto Gambling” scam type noted in the intelligence.

While the exact phishing kit or credential‑capture mechanisms have not been disclosed, the convergence of brand‑specific page title, low trust score, blocklist presence, and multi‑vendor detections provides sufficient evidence for an elevated risk rating. Defenders should continue to block the domain at perimeter firewalls, update URL filtering feeds with the observed IP and hostname, monitor for any re‑hosting attempts, and advise users to avoid any unsolicited communications referencing Bet365 that originate from unknown URLs. Ongoing collection of request headers, DNS query logs, and any future TLS certificates will be required to determine whether the infrastructure is repurposed for new campaigns.