84620[.]xyz

The domain 84620.xyz has been identified as a brand_impersonation threat specifically targeting Bet365, a well-known online betting platform. This domain is currently offline, but prior analysis confirms its use in fraudulent activities designed to deceive users into believing they are interacting with the legitimate Bet365 service. The page title, 'welcome-BET365,' further corroborates the intent to impersonate the brand for malicious purposes, likely to harvest credentials or distribute malware under false pretenses. Technical indicators reveal that 84620.xyz was registered on January 08, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 45.196.247.146, hosted in Hong Kong under AS140224 (Nebula Global LLC), an autonomous system with a history of hosting suspicious infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 18 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist, and its SSL certificate (R13) lacks the extended validation typically associated with legitimate services. The combination of these factors—early detection by multiple vendors, blocklist inclusion, and association with a high-risk hosting provider—elevates the threat classification. As of the latest assessment, 84620.xyz has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future malicious campaigns if reactivated or repurposed. Organizations and individuals are advised to proactively block the domain and its associated IP (45.196.247.146) at the network level to prevent accidental exposure. Security teams should monitor for any resurgence of activity under similar domains, particularly those registered through Gname.com Pte. Ltd. or hosted on Nebula Global LLC infrastructure. End users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available to mitigate potential account compromise.