s109m[.]xyz

The domain s109m.xyz has been confirmed as a brand impersonation phishing site targeting Bet365, a well-known online gambling platform. Analysis indicates the domain is currently offline, but prior activity suggests malicious intent to deceive users into disclosing credentials or financial information under the guise of the legitimate Bet365 brand. The page title, 'welcome-BET365,' directly references the targeted brand, reinforcing the impersonation attempt. Technical indicators reveal the domain was registered on February 19, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 103.233.249.125, hosted in Hong Kong under AS132839 (POWER LINE DATACENTER). VirusTotal detections show 22 of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate, identified as R12, lacks the extended validation typically associated with legitimate enterprises. Infrastructure analysis further indicates the domain was taken offline following detection, though residual risk remains due to its recent creation and association with known high-risk hosting providers. Current status confirms s109m.xyz is offline, reducing immediate exposure. However, organizations and users are advised to treat this domain as malicious and implement proactive measures. Network administrators should block the domain and its associated IP (103.233.249.125) at the perimeter, while endpoint protection systems should be updated to recognize the domain as a confirmed phishing indicator. Users who may have interacted with the site should reset credentials for Bet365 and monitor financial accounts for unauthorized activity. Given the domain's recent creation and registration through a high-risk registrar, continued vigilance is recommended to mitigate potential resurgence or similar threats from related infrastructure.