s95i[.]xyz

This domain, s95i.xyz, was created on 14 December 2025 and is presently taken offline. The site registers a brand impersonation of Bet365, with the page title “welcome‑BET365”, indicating a crypto‑gambling scam. Infrastructure analysis shows the domain resolves to IP 45.196.247.166, which belongs to AS140224 Nebula Global LLC and is geolocated in Hong Kong. The authoritative name servers are A.SHARE‑DNS.COM and B.SHARE‑DNS.NET, and the domain is registered through Gname.com Pte. Ltd. The SSL certificate is identified as R13, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of trust.

Detection telemetry reports that 14 of 95 security vendors on VirusTotal flag the domain, and it appears on a single security blocklist. PhishDestroy has already blocked the domain, and AlienVault OTX lists it in two threat‑intel pulses. The limited blocklist presence and the modest vendor detection count suggest that the malicious infrastructure is still emerging, but the combination of brand impersonation, low trust score, and active blocklist inclusion confirms a credible threat.

Defenders should add the domain and its IP address to local deny lists, monitor for any resurrection attempts, and enforce outbound filtering that blocks connections to the identified IP range. Continuous re‑scanning on VirusTotal and correlation with future OTX pulses are advised to capture any changes in detection status. At present, the primary uncertainty is whether the operators will reactivate the site or shift to a new domain; therefore, threat‑hunting rules that look for similar page titles or the same name‑server pattern may help uncover related campaigns.