s95a[.]xyz

This domain, s95a.xyz, is identified as a brand impersonation threat specifically targeting Bet365, an online gambling and sports betting platform. Analysis confirms the domain was designed to mimic the legitimate Bet365 brand, as evidenced by the page title 'welcome-BET365' and the absence of any legitimate association with the official entity. No drainer kit signatures were detected in initial scans, though the domain exhibits characteristics consistent with credential harvesting or fraudulent betting site redirection.

Technical indicators reveal multiple red flags: the domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating broad detection as malicious. It was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 45.119.97.37, hosted under AS133861 (SonderCloud Limited) in the United States. The domain appears on one security blocklist and lacks an SSL certificate, further reducing its legitimacy. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than benign status.

As of the latest assessment, s95a.xyz has been taken offline, likely due to enforcement actions or hosting provider intervention. The domain's infrastructure remains registered, however, posing a residual risk of reactivation or migration to a new host. Organizations are advised to monitor for DNS resolution attempts to 45.119.97.37 and block the domain at the perimeter. End-users should be alerted to the impersonation risk, particularly in regions where Bet365 operates, and instructed to verify domain authenticity before entering credentials or financial details.