84340[.]xyz

The domain 84340.xyz was observed targeting the Bet365 brand through a page titled “welcome‑BET365”. The domain was registered on 21 February 2026 via Gname.com Pte. Ltd., and its authoritative nameservers are a.share‑dns.com, a11.share‑dns.com, b.share‑dns.net, and b11.share‑dns.net. DNS resolution points to IP address 45.119.97.37, which belongs to AS133861 SonderCloud Limited and is geolocated in the United States. No TLS certificate is presented, indicating the site is served over plain HTTP.

The site has been flagged by 13 of 95 security vendors on VirusTotal, and it appears in two AlienVault OTX threat‑intel pulses. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist. PhishDestroy has already blocked the domain, and the current operational status is reported as offline. Analysis of the available artifacts confirms a brand‑impersonation attempt directed at Bet365 users, likely to lure victims into a crypto‑gambling scheme as indicated by the “Crypto Gambling” classification.

The lack of SSL, combined with the low trust score and multiple vendor detections, suggests a high likelihood of malicious intent. However, the offline status limits immediate observation of the payload or credential‑capture mechanisms, and no additional content beyond the page title has been publicly disclosed. Defenders should continue to monitor the associated IP address and the registrar’s newly created domains for similar patterns, enforce strict URL filtering for the 84340.xyz host, and ensure that any inbound traffic to the identified IP is blocked at the network perimeter. Threat‑intel teams are advised to enrich the indicator set with the observed nameservers and to share the domain’s fingerprint with other blocklist operators to accelerate collective remediation.