b239c[.]xyz

Analysis of the domain b239c.xyz indicates that it is a brand impersonation threat targeting the online sports betting platform Bet365. The domain does not utilize an SSL certificate, which is a common characteristic of phishing sites, and is designed to deceive users into believing they are interacting with the legitimate Bet365 website. The threat level is elevated, as the domain impersonates a well-known brand and could lead to significant financial and personal data loss if users are not cautious.

Technical indicators reveal that the domain b239c.xyz is detected by 18 out of 95 security vendors on VirusTotal, suggesting a moderate level of recognition among security tools. The domain is registered through Gname.com Pte. Ltd., a registrar known for facilitating domain registrations. It resolves to the IP address 45.196.247.26, which is located in Hong Kong and is part of the AS140224 network operated by Nebula Global LLC. The domain was created on February 21, 2026, and currently appears on one security blocklist, indicating its involvement in malicious activities. The domain is not listed in the Google Safe Browsing (GSB) database, but this does not diminish its potential threat.

The domain b239c.xyz has been taken offline, which reduces the immediate risk to users. However, the infrastructure and techniques used in this campaign may still pose a threat if similar domains are registered in the future. It is recommended that users remain vigilant and verify the URL of any website they visit, especially those purporting to be from trusted brands like Bet365. Security teams should monitor for similar domain registrations and IP addresses to prevent future incidents. The current offline status of the domain suggests that it has been mitigated, but ongoing monitoring is essential to ensure complete safety.