x104s[.]xyz

This domain, x104s.xyz, has been confirmed as a brand impersonation site targeting Bet365, a well-known online betting platform. The site is currently offline, but prior analysis indicates it was actively used to deceive users by mimicking the legitimate Bet365 interface, as evidenced by the page title 'welcome-BET365'. The threat type is specifically categorized as brand impersonation, designed to exploit the trust associated with the Bet365 brand for malicious purposes. Analysis of the domain reveals multiple concerning indicators. The domain was flagged by 22 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered on February 23, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 45.196.247.27, located in Hong Kong under AS140224 (Nebula Global LLC). The domain lacks an SSL certificate, a common red flag for fraudulent sites. Additionally, it appears on one security blocklist, further corroborating its malicious nature. Infrastructure analysis reveals no legitimate association with Bet365, and the creation date suggests a short-lived operation typical of phishing campaigns. The domain is currently offline, but organizations and users should remain vigilant. It is recommended to block the domain and its associated IP address (45.196.247.27) at the network level to prevent accidental access. Users who may have interacted with the site should be advised to change their credentials immediately, particularly if they entered sensitive information. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate related malicious activity. Proactive measures, such as domain monitoring and user education on brand impersonation tactics, are advised to mitigate future risks.