84705[.]xyz

On 23 July 2026, the domain 84705.xyz was identified as a brand‑impersonation site targeting Bet365. The site’s HTML title reported “welcome‑BET365”, indicating a direct reference to the gambling brand. Registration data shows the domain was created on 21 February 2026, and DNS resolution points to the IPv4 address 45.196.247.189, which is registered to Nebula Global LLC in Hong Kong under ASN 140224. The hosting infrastructure therefore resides in a jurisdiction often associated with malicious operations.

The SSL certificate presented on the site is identified as R13, a low‑trust certificate frequently observed on fraudulent pages. Reputation services flag the domain: fifteen out of ninety‑three VirusTotal scanners reported detections, and the domain appears on a single public blocklist. PhishDestroy has actively blocked the domain, and two AlienVault OTX pulses reference the indicator, confirming its inclusion in broader threat‑intel feeds. The site’s advertised scam type is “Crypto Gambling”, suggesting that victims were likely enticed to deposit cryptocurrency under the pretense of legitimate betting services.

As of the reporting date the domain is marked offline, which may be a temporary takedown or a shift in the adversary’s infrastructure. Defenders should continue to monitor the IP address 45.196.247.189 for any re‑activation, update URL filtering rules to include 84705.xyz, and ensure that corporate web‑proxy and endpoint protection solutions reference the latest blocklist entries. Network traffic to the associated ASN and any TLS handshakes presenting the R13 certificate should be logged for correlation with potential credential‑theft attempts. Because the domain’s creation date is recent, any future registrations that reuse similar naming patterns or point to the same hosting provider should be treated with heightened scrutiny.