h103c[.]xyz

This domain is flagged for elevated-risk brand impersonation targeting Bet365, a major online gambling platform. The fraudulent infrastructure mimics legitimate Bet365 branding, as evidenced by the page title 'welcome-BET365,' designed to deceive users into believing they are accessing the official service. Analysis indicates this is not a generic phishing attempt but a targeted impersonation scheme, likely intended to harvest login credentials or financial information from unsuspecting victims.

Infrastructure analysis reveals multiple high-risk indicators. The domain h103c.xyz was registered on March 09, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolves to the IP address 45.196.247.26, hosted in Hong Kong under AS140224 (Nebula Global LLC), a network with a history of facilitating malicious activity. The domain lacks an SSL certificate, a critical red flag for user security. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while PhishDestroy and at least one other security blocklist have already classified it as a threat. The domain is currently offline, but its prior activity and infrastructure warrant continued monitoring.

Mitigation steps for this brand impersonation threat include immediate domain suspension via registrar abuse channels, particularly targeting Gname.com Pte. Ltd. Network-level blocking of the IP address 45.196.247.26 and associated AS140224 ranges should be implemented to prevent further resolution. Organizations should update endpoint protection rules to include the domain and its known indicators, while security teams are advised to monitor for similar impersonation patterns, such as domains containing 'bet365' or variations thereof. User awareness training should emphasize verifying SSL certificates and official domain names before entering credentials, as this campaign specifically exploits brand trust to facilitate credential theft.