86269[.]xyz

86269.xyz is a newly registered domain (created 08 Jan 2026) that presents the page title “welcome‑BET365”. The title, together with the explicit brand target “Bet365”, shows that the site attempts to impersonate the online betting service. Registration was performed through Gname.com Pte. Ltd., and the domain resolves to the IPv4 address 45.196.247.160, which is announced by AS140224 (Nebula Global LLC) and geolocated to Hong Kong. The site was taken offline before this report, but historical data indicate that it was flagged by multiple security products: sixteen of ninety‑three VirusTotal scanners reported it as malicious, Gridinsoft assigned a trust score of 0 / 100, and Scamadviser also rated it 0 / 100.

The domain appears on one public blocklist and has been specifically blocked by PhishDestroy. An AlienVault OTX pulse references the domain in a single threat‑intel feed. The SSL certificate is identified as “R12”, which typically denotes a self‑signed or low‑trust certificate, further reducing confidence in the site’s legitimacy. The scam type is listed as “Crypto Gambling”, suggesting that any remaining infrastructure may have been used to lure victims into depositing cryptocurrency under the guise of Bet365 betting.

Because the domain is currently offline, immediate traffic to the host is unlikely, yet the underlying IP address may be reused for other malicious campaigns. Defenders should add 86269.xyz and its resolving IP 45.196.247.160 to blocklists at the perimeter, enforce DNS filtering that drops requests to the domain, and monitor for re‑registration or reuse of the same IP range. Updating intrusion‑detection signatures to include the page title “welcome‑BET365” and the observed SSL fingerprint can improve detection of any future clones. Continuous review of threat‑intel feeds for new pulses referencing the same ASN or registrar is advised to catch related campaigns early.