82895[.]xyz

This domain, 82895.xyz, is assessed as a brand impersonation threat targeting Bet365, specifically linked to crypto gambling fraud. Registered on December 17, 2025, through Gname.com Pte. Ltd., the domain resolved to IP 45.196.247.164, hosted on AS140224 (Nebula Global LLC) in Hong Kong. Nameservers include a.share-dns.com, a9.share-dns.com, b.share-dns.net, and b9.share-dns.net, a pattern consistent with bulletproof or low-reputation DNS providers. The page title, 'welcome-BET365,' directly references the targeted brand, confirming intent to deceive users into believing the site is affiliated with Bet365.

No SSL certificate was detected, increasing the risk of unencrypted credential harvesting or session hijacking. The domain is flagged by 12 of 95 security vendors on VirusTotal and appears on the PhishDestroy blocklist, with additional corroboration from AlienVault OTX, where it is listed in one threat intelligence pulse. Scamadviser and Gridinsoft both assign a trust score of 1/100 and 0/100, respectively, further validating its malicious classification. As of July 23, 2026, the domain is offline, though defenders should treat its infrastructure as compromised and monitor for reactivation or migration to new domains using the same registrar, nameservers, or hosting provider.

The absence of an SSL certificate and the use of high-risk DNS providers suggest a low-effort but potentially effective campaign, likely relying on phishing emails or social engineering to drive traffic. Defenders are advised to block the domain at the DNS and proxy levels, investigate associated IP 45.196.247.164 for lateral movement, and alert users to the Bet365 impersonation risk. Given the domain's recent creation and offline status, it may reappear under a different name or TLD, warranting continuous monitoring of related infrastructure.