89454[.]xyz

Analysis on 89454.xyz indicates that the domain was registered on 21 February 2026 and shortly after began serving content that presents a brand impersonation of Bet365, as evidenced by the page title “welcome‑BET365”. The site is classified as a crypto‑gambling scam, a pattern consistent with recent abuse campaigns that lure victims into fraudulent betting platforms. Infrastructure inspection shows the domain resolves to the IPv4 address 103.233.249.125, which belongs to the POWER LINE DATACENTER network (ASN 132839) located in Hong Kong. The hosting provider is therefore a data‑center environment frequently abused for malicious operations. The TLS certificate presented by the server is identified as “R13”, a known low‑trust certificate that does not convey strong validation.

VirusTotal has recorded 19 detections out of 93 scanning engines, indicating a significant level of malicious labeling by independent security vendors. The domain appears on at least one public blocklist and has been added to the PhishDestroy blocklist, confirming that threat intelligence feeds are already flagging it. Current network measurements show the host is taken offline, which may be a temporary takedown or a defensive response. The observable evidence is limited to the registration date, hosting details, SSL profile, detection counts, and the page title. No additional artifacts such as malware hashes, C2 endpoints, or phishing page screenshots are available in the supplied intelligence, leaving the full scope of the campaign unverified.

Defenders should update URL filtering and DNS block policies to include 89454.xyz and its resolved IP address. Monitoring for re‑hosting of the same content on other IP ranges associated with ASN 132839 is recommended, as actors often migrate to adjacent hosts within the same data‑center.