87483[.]xyz

The domain 87483.xyz has been identified as a brand-impersonation threat specifically targeting Bet365, a well-known online gambling platform. Analysis confirms this domain is designed to deceive users into believing they are interacting with the legitimate Bet365 service, likely for the purpose of harvesting login credentials, financial details, or deploying malicious payloads under the guise of betting promotions. As of the latest assessment, the domain has been taken offline, though its prior activity remains a concern for historical exposure. Infrastructure analysis reveals that 87483.xyz was flagged by 18 of 95 security vendors on VirusTotal, indicating a significant detection rate among threat intelligence platforms. The domain was registered on February 21, 2026, a date that may suggest an attempt to evade scrutiny by appearing newly established. It resolved to the IP address 45.196.247.147, hosted under AS140224 (Nebula Global LLC) in Hong Kong, a jurisdiction frequently associated with high-risk hosting providers. The domain appeared on one security blocklist and was blocked by PhishDestroy, further corroborating its malicious classification. The SSL certificate, identified as R12, is a low-trust indicator often linked to automated or short-lived malicious domains. The page title, 'welcome-BET365,' explicitly confirms the intent to impersonate the Bet365 brand. Current status indicates that 87483.xyz is offline, reducing immediate exposure risks. However, the domain's infrastructure and historical activity warrant continued monitoring. Organizations and users are advised to implement the following mitigations: block the domain and its associated IP (45.196.247.147) at the network perimeter, update endpoint protection rules to include this indicator of compromise, and conduct retrospective log analysis to identify any prior interactions with the domain. Users who may have engaged with the site should reset credentials for Bet365 and any other accounts where identical passwords were reused. Security teams should treat domains with similar characteristics—such as newly registered, low-trust SSL certificates, and hosting in high-risk autonomous systems—as high-priority threats for further investigation.