x82t[.]xyz

Analysis indicates that the domain x82t.xyz, created on 14 November 2025 and currently taken offline, was used to impersonate the Bet365 betting brand. The site presented the page title “welcome-BET365”, which aligns with the reported brand impersonation vector. Registration was performed through Gname.com Pte. Ltd., and the authoritative name servers observed are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4., ns1.dnsbm.com and ns2.dnsbm.com. DNS resolution points to the IPv4 address 45.196.247.207, an address located in Hong Kong and announced by AS140224 (Nebula Global LLC).

No TLS certificate was observed, implying that the service operated over plain HTTP. VirusTotal scans show that 16 of 95 antivirus and URL‑reputation engines flagged the domain as malicious, and the domain appears on a single security blocklist, with PhishDestroy already listing it as blocked. AlienVault OTX references include fifteen distinct threat‑intel pulses referencing the same indicator. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment.

The observed infrastructure suggests a low‑cost hosting setup commonly leveraged for cryptocurrency‑gambling scams that co‑opt the Bet365 brand. Because the site is presently offline, direct verification of content is not possible; however, the collected metadata provides sufficient evidence for defensive actions. Recommendations for security operations include adding 45.196.247.207 to network deny lists, enforcing blocklist rules for x82t.xyz, monitoring future registrations from the same registrar and name‑server patterns, and updating URL‑filtering solutions with the observed detection counts. Continuous threat‑intel feed monitoring should be employed to capture any re‑use of the identified IP or similar domains.