82891[.]xyz

The domain 82891.xyz was registered on 17 December 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 45.196.247.170, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. The authoritative name servers are a.share-dns.com, a2.share-dns.com, b.share-dns.net, and b2.share-dns.net, a pattern that appears in other malicious infrastructure. No TLS certificate is presented; the site was reachable only over HTTP before being taken offline, and the page title returned was “welcome-BET365”, indicating a direct brand impersonation of Bet365. The threat is classified as a crypto‑gambling scam that leverages the Bet365 brand to lure victims.

Reputation services flag the domain extremely poorly: Gridinsoft assigns a trust score of 0/100, Scamadviser a score of 1/100, and the domain appears on one security blocklist, specifically PhishDestroy. AlienVault OTX lists the domain in one pulse, and VirusTotal recorded 13 positive detections out of 95 scanning engines. The combination of low trust scores, blocklist presence, and multiple vendor detections demonstrates a high likelihood of malicious activity. Given the offline status, immediate mitigation focuses on pre‑emptive controls.

Defensive teams should add 82891.xyz and its resolved IP 45.196.247.170 to network deny lists, enforce DNS filtering for the shared‑dns name servers, and monitor for any resurgence of the domain or sibling domains using the same name server set. Continuous threat‑intel feeds should be consulted for new pulses referencing the same IP block or registrar. Because the site targeted Bet365, organisations that provide access to betting platforms should educate users about unsolicited crypto‑gambling offers that reference Bet365 and enforce strict URL verification. Until the domain is confirmed clean, it should remain blocked.